CVE-2016-10028

NameCVE-2016-10028
DescriptionThe virgl_cmd_get_capset function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) built with Virtio GPU Device emulator support allows local guest OS users to cause a denial of service (out-of-bounds read and process crash) via a VIRTIO_GPU_CMD_GET_CAPSET command with a maximum capabilities size with a value of 0.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
NVD severitylow (attack range: local)
Debian Bugs849798

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
qemu (PTS)wheezy1.1.2+dfsg-6a+deb7u12fixed
wheezy (security)1.1.2+dfsg-6+deb7u23fixed
jessie, jessie (security)1:2.1+dfsg-12+deb8u6fixed
stretch1:2.8+dfsg-6vulnerable
stretch (security)1:2.8+dfsg-6+deb9u2vulnerable
buster, sid1:2.8+dfsg-7vulnerable
qemu-kvm (PTS)wheezy1.1.2+dfsg-6+deb7u12fixed
wheezy (security)1.1.2+dfsg-6+deb7u23fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
qemusource(unstable)(unfixed)unimportant849798
qemusourcejessie(not affected)
qemusourcewheezy(not affected)
qemu-kvmsource(unstable)(not affected)

Notes

[jessie] - qemu <not-affected> (Vulnerable code not present)
[wheezy] - qemu <not-affected> (Vulnerable code not present)
- qemu-kvm <not-affected> (Vulnerable code not present)
https://lists.gnu.org/archive/html/qemu-devel/2016-12/msg01903.html
http://www.openwall.com/lists/oss-security/2016/12/20/1
Marked as unimportant, since 1:2.8+dfsg-2 reverted the support for
virtio gpu (virglrenderer) and opengl, but the affected code is
still present.
Fixed by: http://git.qemu.org/?p=qemu.git;a=commit;h=abd7f08b2353f43274b785db8c7224f082ef4d31 (v2.9.0-rc0)

Search for package or bug name: Reporting problems