CVE-2013-2016 in QEMU

Summary

A flaw was found in the way qemu v1.3.0 and later (virtio-rng) validates addresses when guest accesses the config space of a virtio device. If the virtio device has zero/small sized config space, such as virtio-rng, a privileged guest user could use this flaw to access the matching host's qemu address space and thus increase their privileges on the host.

Reservation

02/19/2013

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
147884	QEMU Virtio privileges management	269	Not defined	Official fix	CVE-2013-2016
8570	Linux Kernel QEMU Addresse Validator privileges management	269	Not defined	Official fix	CVE-2013-2016