CVE Feed

    Dashboard / CVE / CVE-2016-1714

    CVE-2016-1714

    The (1) fw_cfg_write and (2) fw_cfg_read functions in hw/nvram/fw_cfg.c in QEMU before 2.4, when built with the Firmware Configuration device emulation support, allow guest OS users with the CAP_SYS_RAWIO privilege to cause a denial of service (out-of-bounds read or write access and process crash) or possibly execute arbitrary code via an invalid current entry value in a firmware configuration.

    Published:Jan 5, 2016
    Last Modified:Apr 12, 2025
    EPS:Apr 7, 2016
    EPSS Score:0.00158
    CVSS Score:8.1

    Affected Products

    Vendor
    Oracle
    Product
    Linux
    Vendor
    Qemu
    Product
    Qemu
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Openstack

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-35233 (CVSS 4.4) — An unprivileged attacker can craft a user-space process with a malicious ELF binary containing an out-of-range…
    CVE-2026-21996 (CVSS 3.3) — An unprivileged attacker can reliably trigger a crash of the dtrace process with a malicious ELF binary due to…
    CVE-2026-21991 (CVSS 5.5) — A DTrace component, dtprobed, allows arbitrary file creation through crafted USDT provider names.…
    CVE-2025-4598 (CVSS 4.7) — A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash a…
    CVE-2023-22024 (CVSS 5.5) — In the Unbreakable Enterprise Kernel (UEK), the RDS module in UEK has two setsockopt(2) options, RDS_CONN_RESE…
    CVE-2022-21385 (CVSS 6.2) — A flaw in net_rds_alloc_sgs() in Oracle Linux kernels allows unprivileged local users to crash the machine. CV…
    CVE-2022-21505 (CVSS 6.7) — In the linux kernel, if IMA appraisal is used with the "ima_appraise=log" boot param, lockdown can be defeated…
    CVE-2022-21504 (CVSS 5.5) — The code in UEK6 U3 was missing an appropiate file descriptor count to be missing. This resulted in a use coun…
    CVE-2022-21499 (CVSS 6.7) — KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown. An a…
    CVE-2021-2464 (CVSS 7.8) — Vulnerability in Oracle Linux (component: OSwatcher). Supported versions that are affected are 7 and 8. Easily…

    References

    http://rhn.redhat.com/errata/RHSA-2016-0081.html
    http://rhn.redhat.com/errata/RHSA-2016-0082.html
    http://rhn.redhat.com/errata/RHSA-2016-0083.html
    http://rhn.redhat.com/errata/RHSA-2016-0084.html
    http://rhn.redhat.com/errata/RHSA-2016-0085.html
    http://rhn.redhat.com/errata/RHSA-2016-0086.html
    http://rhn.redhat.com/errata/RHSA-2016-0087.html
    http://rhn.redhat.com/errata/RHSA-2016-0088.html
    http://www.debian.org/security/2016/dsa-3469
    http://www.debian.org/security/2016/dsa-3470
    http://www.debian.org/security/2016/dsa-3471
    http://www.openwall.com/lists/oss-security/2016/01/11/7
    http://www.openwall.com/lists/oss-security/2016/01/12/10
    http://www.openwall.com/lists/oss-security/2016/01/12/11
    http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
    http://www.securityfocus.com/bid/80250
    http://www.securitytracker.com/id/1034858
    https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg00428.html
    https://security.gentoo.org/glsa/201604-01
    http://rhn.redhat.com/errata/RHSA-2016-0081.html
    http://rhn.redhat.com/errata/RHSA-2016-0082.html
    http://rhn.redhat.com/errata/RHSA-2016-0083.html
    http://rhn.redhat.com/errata/RHSA-2016-0084.html
    http://rhn.redhat.com/errata/RHSA-2016-0085.html
    http://rhn.redhat.com/errata/RHSA-2016-0086.html
    http://rhn.redhat.com/errata/RHSA-2016-0087.html
    http://rhn.redhat.com/errata/RHSA-2016-0088.html
    http://www.debian.org/security/2016/dsa-3469
    http://www.debian.org/security/2016/dsa-3470
    http://www.debian.org/security/2016/dsa-3471
    http://www.openwall.com/lists/oss-security/2016/01/11/7
    http://www.openwall.com/lists/oss-security/2016/01/12/10
    http://www.openwall.com/lists/oss-security/2016/01/12/11
    http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
    http://www.securityfocus.com/bid/80250
    http://www.securitytracker.com/id/1034858
    https://lists.gnu.org/archive/html/qemu-devel/2016-01/msg00428.html
    https://security.gentoo.org/glsa/201604-01

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High