QEMU, when built with the Pseudo Random Number Generator (PRNG) back-end support, allows local guest OS users to cause a denial of service (process crash) via an entropy request, which triggers arbitrary stack based allocation and memory corruption.
The MITRE CVE dictionary describes this issue as:
Find out more about CVE-2016-2858 from the MITRE CVE dictionary dictionary and NIST NVD.
This has been rated as having Low security impact and is not currently
planned to be addressed in future updates. For additional information, refer
to the Red Hat Enterprise Linux Life Cycle:
https://access.redhat.com/support/policy/updates/errata/.
NOTE: The following CVSS v2 metrics and score provided are preliminary and subject to review.
| Base Score | 4.3 |
|---|---|
| Base Metrics | AV:A/AC:M/Au:N/C:N/I:P/A:P |
| Access Vector | Adjacent Network |
| Access Complexity | Medium |
| Authentication | None |
| Confidentiality Impact | None |
| Integrity Impact | Partial |
| Availability Impact | Partial |
Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).
| Platform | Package | State |
|---|---|---|
| Red Hat OpenStack Platform 8.0 (Liberty) | qemu-kvm-rhev | Will not fix |
| Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 | qemu-kvm-rhev | Will not fix |
| Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7 | qemu-kvm-rhev | Will not fix |
| Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) | qemu-kvm-rhev | Will not fix |
| Red Hat Enterprise Linux 7 | qemu-kvm-rhev | Will not fix |
| Red Hat Enterprise Linux 7 | qemu-kvm | Will not fix |
| Red Hat Enterprise Linux 6 | qemu-kvm | Will not fix |
| Red Hat Enterprise Linux 5 | kvm | Not affected |
| Red Hat Enterprise Linux 5 | xen | Not affected |
Vulmon