CVE-2016-1714

Description

The (1) fw_cfg_write and (2) fw_cfg_read functions in hw/nvram/fw_cfg.c in QEMU before 2.4, when built with the Firmware Configuration device emulation support, allow guest OS users with the CAP_SYS_RAWIO privilege to cause a denial of service (out-of-bounds read or write access and process crash) or possibly execute arbitrary code via an invalid current entry value in a firmware configuration.

Risk Information

Base Score

8.1

MODERATE

Vector

CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS Score

Exploitation Probability

0.343

Associated Vulnerability

Vulnerability	OS Platform
Multiple vulnerabilities affected in QEMU 2.3.0	Windows
Multiple Vulnerabilities are affected in QEMU 2.3.0	Windows
Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2016-1714)	NCM

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234