CVE-2016-2857
An out-of-bounds read-access flaw was found in the QEMU emulator built with IP checksum routines. The flaw could occur when computing a TCP/UDP packet's checksum, because a QEMU function used the packet's payload length without checking against the data buffer's size. A user inside a guest could use this flaw to crash the QEMU process (denial of service).
Find out more about CVE-2016-2857 from the MITRE CVE dictionary dictionary and NIST NVD.
Statement
This has been rated as having Low security impact and is not currently
planned to be addressed in future updates. For additional information, refer
to the Red Hat Enterprise Linux Life Cycle:
https://access.redhat.com/support/policy/updates/errata/.
CVSS v2 metrics
| Base Score | 4.3 |
|---|---|
| Base Metrics | AV:A/AC:M/Au:N/C:P/I:N/A:P |
| Access Vector | Adjacent Network |
| Access Complexity | Medium |
| Authentication | None |
| Confidentiality Impact | Partial |
| Integrity Impact | None |
| Availability Impact | Partial |
CVSS v3 metrics
| CVSS3 Base Score | 4.7 |
|---|---|
| CVSS3 Base Metrics | CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:L |
| Attack Vector | Adjacent Network |
| Attack Complexity | High |
| Privileges Required | None |
| User Interaction | None |
| Scope | Changed |
| Confidentiality | Low |
| Integrity Impact | None |
| Availability Impact | Low |
Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).
Red Hat Security Errata
| Platform | Errata | Release Date |
|---|---|---|
| Red Hat Enterprise Linux 6 (qemu-kvm) | RHSA-2017:0309 | 2017-02-23 |
| Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 (qemu-kvm-rhev) | RHSA-2016:2704 | 2016-11-14 |
| Red Hat OpenStack Platform 9.0 (qemu-kvm-rhev) | RHSA-2016:2671 | 2016-11-07 |
| RHEV Agents (vdsm) (qemu-kvm-rhev) | RHSA-2017:0344 | 2017-02-28 |
| Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7 (qemu-kvm-rhev) | RHSA-2016:2705 | 2016-11-14 |
| Red Hat Enterprise Linux 7 (qemu-kvm) | RHSA-2017:0083 | 2017-01-17 |
| Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6 (qemu-kvm-rhev) | RHSA-2017:0334 | 2017-02-27 |
| Red Hat OpenStack Platform 8.0 (Liberty) (qemu-kvm-rhev) | RHSA-2016:2670 | 2016-11-07 |
| Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7 (qemu-kvm-rhev) | RHSA-2016:2706 | 2016-11-14 |
| Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts (qemu-kvm-rhev) | RHSA-2017:0350 | 2017-03-01 |
Affected Packages State
| Platform | Package | State |
|---|---|---|
| Red Hat OpenStack Platform 11.0 (Ocata) | qemu-kvm-rhev | Not affected |
| Red Hat OpenStack Platform 10 | qemu-kvm-rhev | Not affected |
| Red Hat Enterprise Linux 5 | kvm | Will not fix |