Vulnetix
Try Vulnetix Request Demo
CVE-2013-2016 PUBLISHED CVSS 7.800000190734863 HIGH

A flaw was found in the way qemu v1.3.0 and later (virtio-rng) validates addresses when guest accesses the config space of a virtio device. If the virtio device has zero/small sized config space, such as virtio-rng, a privileged guest user could use this flaw to access the matching host's qemu address space and thus increase their privileges on the host.

EPSS 0.07% · 22.2th percentile

Risk Scores

CVSS v3.1
7.800000190734863
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score
0.07%
22.2th percentile

Affected Products

VendorProductVersions
qemuqemu (virtio-rng)v1.3.0 and later
novellopen_desktop_server11.0
debiandebian_linux9.0, 8.0, 10.0
qemuqemu1.3.0, 1.5.0
novellopen_enterprise_server11.0

Timeline

References

Open in Interactive Console →