CVE-2015-5154

CVE Details

Release Date:	2015-07-27
Impact:	Important	What is this?

Description

A heap buffer overflow flaw was found in the way QEMU's IDE subsystem handled I/O buffer access while processing certain ATAPI commands. A privileged guest user in a guest with the CDROM drive enabled could potentially use this flaw to execute arbitrary code on the host with the privileges of the host's QEMU process corresponding to the guest.

See more information about CVE-2015-5154 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v2 metrics

Base Score:	6.5
Vector String:	AV:A/AC:H/Au:S/C:C/I:C/A:C
Version:	2.0
Attack Vector:	Adjacent Network
Attack Complexity:	High
Authentication:	Single
Confidentiality Impact:	Complete
Integrity Impact:	Complete
Availability Impact:	Complete

Errata information

Platform	Errata	Release Date
Oracle Linux version 7 (qemu-kvm)	ELSA-2015-1507	2015-07-27
Oracle VM version 3.2 (xen)	OVMSA-2015-0096	2015-07-27
Oracle VM version 3.3 (xen)	OVMSA-2015-0095	2015-07-27