Vulnerability Database

289,599

Total vulnerabilities in the database

CVE-2013-2016

A flaw was found in the way qemu v1.3.0 and later (virtio-rng) validates addresses when guest accesses the config space of a virtio device. If the virtio device has zero/small sized config space, such as virtio-rng, a privileged guest user could use this flaw to access the matching host's qemu address space and thus increase their privileges on the host.

  • Published: Dec 30, 2019
  • Updated: Apr 13, 2023
  • CVE: CVE-2013-2016
  • Severity: High
  • Exploit:

CVSS v3:

  • Severity: High
  • Score: 7.8
  • AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

  • Severity: Medium
  • Score: 6.9
  • AV:L/AC:M/Au:N/C:C/I:C/A:C

CWEs:

Software From Fixed in
qemu / qemu 1.5.0-rc1 1.5.0-rc1.x
qemu / qemu 1.3.0 1.4.2.x
debian / debian_linux 8.0 8.0.x
debian / debian_linux 9.0 9.0.x
debian / debian_linux 10.0 10.0.x
novell / open_desktop_server 11.0-sp3 11.0-sp3.x
novell / open_enterprise_server 11.0-sp3 11.0-sp3.x