CVE-2016-2857

CVSS V2 Low 3.6 CVSS V3 High 8.4
Description
The net_checksum_calculate function in net/checksum.c in QEMU allows local guest OS users to cause a denial of service (out-of-bounds heap read and crash) via the payload length in a crafted packet.
Overview
  • CVE ID
  • CVE-2016-2857
  • Assigner
  • secalert@redhat.com
  • Vulnerability Status
  • Modified
  • Published Version
  • 2016-04-12T02:00:07
  • Last Modified Date
  • 2023-02-12T23:17:48
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
AND
cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:* 1 OR 2.5.1.1
AND
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:* 1 OR
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* 1 OR
cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* 1 OR
AND
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* 1 OR
AND
cpe:2.3:a:redhat:openstack:5.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:redhat:virtualization:3.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:a:redhat:openstack:5.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:redhat:virtualization:3.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* 0 OR
AND
cpe:2.3:a:redhat:openstack:6.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:redhat:openstack:7.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:redhat:openstack:8:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:redhat:openstack:9:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_eus:7.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* 1 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:L/AC:L/Au:N/C:P/I:N/A:P
  • Access Vector
  • LOCAL
  • Access Compatibility
  • LOW
  • Authentication
  • NONE
  • Confidentiality Impact
  • PARTIAL
  • Integrity Impact
  • NONE
  • Availability Impact
  • PARTIAL
  • Base Score
  • 3.6
  • Severity
  • LOW
  • Exploitability Score
  • 3.9
  • Impact Score
  • 4.9
CVSS Version 3
  • Version
  • 3.1
  • Vector String
  • CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H
  • Attack Vector
  • LOCAL
  • Attack Compatibility
  • LOW
  • Privileges Required
  • LOW
  • User Interaction
  • NONE
  • Scope
  • CHANGED
  • Confidentiality Impact
  • HIGH
  • Availability Impact
  • HIGH
  • Base Score
  • 8.4
  • Base Severity
  • HIGH
  • Exploitability Score
  • 2
  • Impact Score
  • 5.8
References
Reference URL Reference Tags
http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=362786f14a753d8a5256ef97d7c10ed576d6572b
http://rhn.redhat.com/errata/RHSA-2016-2670.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-2671.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-2704.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-2705.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-2706.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-0083.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-0309.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-0334.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-0344.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-0350.html Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/03/03/9 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/03/07/3 Mailing List Third Party Advisory
http://www.securityfocus.com/bid/84130 Third Party Advisory VDB Entry
http://www.ubuntu.com/usn/USN-2974-1 Third Party Advisory
https://access.redhat.com/errata/RHSA-2016:2670
https://access.redhat.com/errata/RHSA-2016:2671
https://access.redhat.com/errata/RHSA-2016:2704
https://access.redhat.com/errata/RHSA-2016:2705
https://access.redhat.com/errata/RHSA-2016:2706
https://access.redhat.com/errata/RHSA-2017:0083
https://access.redhat.com/errata/RHSA-2017:0309
https://access.redhat.com/errata/RHSA-2017:0334
https://access.redhat.com/errata/RHSA-2017:0344
https://access.redhat.com/errata/RHSA-2017:0350
https://access.redhat.com/security/cve/CVE-2016-2857
https://bugzilla.redhat.com/show_bug.cgi?id=1296567
https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html Mailing List Third Party Advisory
History
Created Old Value New Value Data Type Notes
2022-05-10 06:58:19 Added to TrackCVE
2022-12-02 08:53:09 2016-04-12T02:00Z 2016-04-12T02:00:07 CVE Published Date updated
2022-12-02 08:53:09 2021-08-04T17:15:35 CVE Modified Date updated
2022-12-02 08:53:09 Analyzed Vulnerability Status updated
2023-02-02 22:06:04 2023-02-02T21:16:34 CVE Modified Date updated
2023-02-02 22:06:04 Analyzed Modified Vulnerability Status updated
2023-02-02 22:06:04 The net_checksum_calculate function in net/checksum.c in QEMU allows local guest OS users to cause a denial of service (out-of-bounds heap read and crash) via the payload length in a crafted packet. An out-of-bounds read-access flaw was found in the QEMU emulator built with IP checksum routines. The flaw could occur when computing a TCP/UDP packet's checksum, because a QEMU function used the packet's payload length without checking against the data buffer's size. A user inside a guest could use this flaw to crash the QEMU process (denial of service). Description updated
2023-02-02 22:06:10 References updated
2023-02-13 01:06:34 2023-02-12T23:17:48 CVE Modified Date updated
2023-02-13 01:06:34 An out-of-bounds read-access flaw was found in the QEMU emulator built with IP checksum routines. The flaw could occur when computing a TCP/UDP packet's checksum, because a QEMU function used the packet's payload length without checking against the data buffer's size. A user inside a guest could use this flaw to crash the QEMU process (denial of service). The net_checksum_calculate function in net/checksum.c in QEMU allows local guest OS users to cause a denial of service (out-of-bounds heap read and crash) via the payload length in a crafted packet. Description updated