CVE-2016-2392

Impact:
Low
Public Date:
2016-02-11
CWE:
CWE-476
Bugzilla:
1302299: CVE-2016-2392 Qemu: usb: null pointer dereference in remote NDIS control message handling
A NULL pointer dereference flaw was found in the QEMU emulator built with USB Net device emulation support. The flaw could occur while processing remote NDIS control message packets, if the USB configuration descriptor object is NULL. A privileged user inside a guest could exploit this flaw to crash the QEMU process instance (denial of service).

Find out more about CVE-2016-2392 from the MITRE CVE dictionary dictionary and NIST NVD.

Statement

This has been rated as having Low security impact and is not currently
planned to be addressed in future updates. For additional information, refer
to the Red Hat Enterprise Linux Life Cycle:
https://access.redhat.com/support/policy/updates/errata/.

CVSS v2 metrics

NOTE: The following CVSS v2 metrics and score provided are preliminary and subject to review.

Base Score 2.3
Base Metrics AV:A/AC:M/Au:S/C:N/I:N/A:P
Access Vector Adjacent Network
Access Complexity Medium
Authentication Single
Confidentiality Impact None
Integrity Impact None
Availability Impact Partial

Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).

Affected Packages State

Platform Package State
Red Hat OpenStack Platform 8.0 (Liberty) qemu-kvm-rhev Not affected
Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 qemu-kvm-rhev Not affected
Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7 qemu-kvm-rhev Not affected
Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) qemu-kvm-rhev Not affected
Red Hat Enterprise Linux 7 qemu-kvm-rhev Will not fix
Red Hat Enterprise Linux 7 qemu-kvm Will not fix
Red Hat Enterprise Linux 6 qemu-kvm Not affected
Red Hat Enterprise Linux 6 qemu-kvm-rhev Not affected
Red Hat Enterprise Linux 5 kvm Not affected
Red Hat Enterprise Linux 5 xen Not affected

Acknowledgements

Red Hat would like to thank Qinghao Tang (QIHU 360 Marvel Team) for reporting this issue.

Last Modified
Close

Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.