NetSight
IP …
medium6.5

CVE-2016-4020

The patch_instruction function in hw/i386/kvmvapic.c in QEMU does not initialize the imm32 variable, which allows local guest OS administrators to obtain sensi…

Impact

The patch_instruction function in hw/i386/kvmvapic.c in QEMU does not initialize the imm32 variable, which allows local guest OS administrators to obtain sensitive information from host stack memory by accessing the Task Priority Register (TPR).

Affected products

VendorProductAffected versions
QemuQemu
through 2.6.2
CanonicalUbuntu Linux
Versions 12.04, 14.04, 15.10, 16.04
DebianDebian Linux
Version 8.0
RedhatOpenstack
Versions 6.0, 7.0, 8, 9, 10, 11
RedhatEnterprise Linux Desktop
Version 7.0
RedhatEnterprise Linux Eus
Versions 7.4, 7.5, 7.6, 7.7
RedhatEnterprise Linux Server
Version 7.0
RedhatEnterprise Linux Server Aus
Versions 7.4, 7.6, 7.7
RedhatEnterprise Linux Server Tus
Versions 7.6, 7.7
RedhatEnterprise Linux Workstation
Version 7.0
RedhatVirtualization
Version 4.0

References