CVE-2015-3214

CVSS V2 Medium 6.9 CVSS V3 None
Description
The pit_ioport_read in i8254.c in the Linux kernel before 2.6.33 and QEMU before 2.3.1 does not distinguish between read lengths and write lengths, which might allow guest OS users to execute arbitrary code on the host OS by triggering use of an invalid index.
Overview
  • CVE ID
  • CVE-2015-3214
  • Assigner
  • secalert@redhat.com
  • Vulnerability Status
  • Modified
  • Published Version
  • 2015-08-31T10:59:07
  • Last Modified Date
  • 2023-02-13T00:48:24
Weakness Enumerations
CWE URL
CWE-119 http://cwe.mitre.org/data/definitions/119.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:* 1 OR 2.3.0
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 1 OR 2.6.32
cpe:2.3:o:arista:eos:4.12:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:arista:eos:4.13:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:arista:eos:4.14:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:arista:eos:4.15:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:lenovo:emc_px12-400r_ivx:*:*:*:*:*:*:*:* 1 OR 1.0.10.33264
cpe:2.3:o:lenovo:emc_px12-450r_ivx:*:*:*:*:*:*:*:* 1 OR 1.0.10.33264
cpe:2.3:a:redhat:openstack:5.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:redhat:openstack:6.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:redhat:virtualization:3.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_compute_node_eus:7.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_compute_node_eus:7.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_compute_node_eus:7.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_compute_node_eus:7.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_compute_node_eus:7.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_compute_node_eus:7.6:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_compute_node_eus:7.7:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.1_ppc64:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.2_ppc64:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.3_ppc64:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.4_ppc64:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.5_ppc64:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.6_ppc64:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian_eus:7.7_ppc64:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.7:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_server_from_rhui:7.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:7.2:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:7.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:7.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:7.6:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:7.7:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* 1 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:L/AC:M/Au:N/C:C/I:C/A:C
  • Access Vector
  • LOCAL
  • Access Compatibility
  • MEDIUM
  • Authentication
  • NONE
  • Confidentiality Impact
  • COMPLETE
  • Integrity Impact
  • COMPLETE
  • Availability Impact
  • COMPLETE
  • Base Score
  • 6.9
  • Severity
  • MEDIUM
  • Exploitability Score
  • 3.4
  • Impact Score
  • 10
References
Reference URL Reference Tags
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ee73f656a604d5aa9df86a97102e4e462dd79924 Patch Vendor Advisory
http://mirror.linux.org.au/linux/kernel/v2.6/ChangeLog-2.6.33 Broken Link Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-1507.html Issue Tracking Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1508.html Issue Tracking Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1512.html Third Party Advisory
http://www.debian.org/security/2015/dsa-3348 Issue Tracking Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/06/25/7 Mailing List
http://www.securityfocus.com/bid/75273 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1032598 Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2015:1507
https://access.redhat.com/errata/RHSA-2015:1508
https://access.redhat.com/errata/RHSA-2015:1512
https://access.redhat.com/security/cve/CVE-2015-3214
https://bugzilla.redhat.com/show_bug.cgi?id=1229640 Issue Tracking
https://github.com/torvalds/linux/commit/ee73f656a604d5aa9df86a97102e4e462dd79924 Patch Third Party Advisory
https://security.gentoo.org/glsa/201510-02 Issue Tracking Third Party Advisory
https://support.lenovo.com/product_security/qemu Third Party Advisory
https://support.lenovo.com/us/en/product_security/qemu Third Party Advisory
https://www.arista.com/en/support/advisories-notices/security-advisories/1180-security-advisory-13 Third Party Advisory
https://www.exploit-db.com/exploits/37990/ Third Party Advisory VDB Entry
https://www.mail-archive.com/qemu-devel%40nongnu.org/msg304138.html
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2015-3214
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3214
History
Created Old Value New Value Data Type Notes
2022-05-10 06:32:09 Added to TrackCVE
2022-12-02 06:10:45 2015-08-31T10:59Z 2015-08-31T10:59:07 CVE Published Date updated
2022-12-02 06:10:45 2022-02-20T05:55:17 CVE Modified Date updated
2022-12-02 06:10:45 Analyzed Vulnerability Status updated
2023-02-02 21:05:07 2023-02-02T20:20:24 CVE Modified Date updated
2023-02-02 21:05:07 Analyzed Modified Vulnerability Status updated
2023-02-02 21:05:07 The pit_ioport_read in i8254.c in the Linux kernel before 2.6.33 and QEMU before 2.3.1 does not distinguish between read lengths and write lengths, which might allow guest OS users to execute arbitrary code on the host OS by triggering use of an invalid index. An out-of-bounds memory access flaw, leading to memory corruption or possibly an information leak, was found in QEMU's pit_ioport_read() function. A privileged guest user in a QEMU guest, which had QEMU PIT emulation enabled, could potentially, in rare cases, use this flaw to execute arbitrary code on the host with the privileges of the hosting QEMU process. Description updated
2023-02-02 21:05:14 References updated
2023-02-13 01:06:06 2023-02-13T00:48:24 CVE Modified Date updated
2023-02-13 01:06:06 An out-of-bounds memory access flaw, leading to memory corruption or possibly an information leak, was found in QEMU's pit_ioport_read() function. A privileged guest user in a QEMU guest, which had QEMU PIT emulation enabled, could potentially, in rare cases, use this flaw to execute arbitrary code on the host with the privileges of the hosting QEMU process. The pit_ioport_read in i8254.c in the Linux kernel before 2.6.33 and QEMU before 2.3.1 does not distinguish between read lengths and write lengths, which might allow guest OS users to execute arbitrary code on the host OS by triggering use of an invalid index. Description updated