Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
6.9
CVSSv2

CVE-2015-3214

Published: 31/08/2015 Updated: 13/02/2023
CVSS v2 Base Score: 6.9 | Impact Score: 10 | Exploitability Score: 3.4
VMScore: 695
Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C
Subscribe to Linux

Vulnerability Summary

The pit_ioport_read in i8254.c in the Linux kernel prior to 2.6.33 and QEMU prior to 2.3.1 does not distinguish between read lengths and write lengths, which might allow guest OS users to execute arbitrary code on the host OS by triggering use of an invalid index.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

linux linux kernel

qemu qemu

arista eos 4.15

arista eos 4.14

arista eos 4.13

arista eos 4.12

debian debian linux 8.0

debian debian linux 7.0

lenovo emc px12-450r ivx

lenovo emc px12-400r ivx

redhat enterprise linux workstation 7.0

redhat enterprise linux for scientific computing 7.0

redhat openstack 5.0

redhat enterprise linux server 7.0

redhat enterprise linux server eus 7.2

redhat enterprise linux for power big endian eus 7.1_ppc64

redhat enterprise linux server eus 7.1

redhat enterprise linux server tus 7.3

redhat enterprise linux compute node eus 7.1

redhat enterprise linux for power big endian 7.0

redhat openstack 6.0

redhat enterprise linux server aus 7.3

redhat enterprise linux server aus 7.4

redhat enterprise linux server eus 7.3

redhat enterprise linux server eus 7.4

redhat enterprise linux server eus 7.5

redhat virtualization 3.0

redhat enterprise linux server tus 7.6

redhat enterprise linux server eus 7.6

redhat enterprise linux server aus 7.6

redhat enterprise linux server eus 7.7

redhat enterprise linux server aus 7.7

redhat enterprise linux server tus 7.7

redhat enterprise linux server update services for sap solutions 7.6

redhat enterprise linux server update services for sap solutions 7.7

redhat enterprise linux server update services for sap solutions 7.4

redhat enterprise linux server update services for sap solutions 7.3

redhat enterprise linux for power big endian eus 7.2_ppc64

redhat enterprise linux compute node eus 7.2

redhat enterprise linux compute node eus 7.3

redhat enterprise linux compute node eus 7.4

redhat enterprise linux compute node eus 7.5

redhat enterprise linux compute node eus 7.6

redhat enterprise linux compute node eus 7.7

redhat enterprise linux server update services for sap solutions 7.2

redhat enterprise linux for power big endian eus 7.3_ppc64

redhat enterprise linux for power big endian eus 7.4_ppc64

redhat enterprise linux for power big endian eus 7.5_ppc64

redhat enterprise linux for power big endian eus 7.6_ppc64

redhat enterprise linux for power big endian eus 7.7_ppc64

redhat enterprise linux server from rhui 7.0

Vendor Advisories

Ubuntu Security Notice: qemu vulnerabilities
Several security issues were fixed in QEMU ...
Debian Security Advisories: DSA-3348-1 qemu -- security update
Several vulnerabilities were discovered in qemu, a fast processor emulator CVE-2015-3214 Matt Tait of Google's Project Zero security team discovered a flaw in the QEMU i8254 PIT emulation A privileged guest user in a guest with QEMU PIT emulation enabled could potentially use this flaw to execute arbitrary code on the host with t ...
Debian CVElist Bug Report Logs: qemu: CVE-2015-5166: Use after free in QEMU/Xen block unplug protocol
Debian Bug report logs - #794611 qemu: CVE-2015-5166: Use after free in QEMU/Xen block unplug protocol Package: src:qemu; Maintainer for src:qemu is Debian QEMU Team <pkg-qemu-devel@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 4 Aug 2015 20:27:02 UTC Severity: important ...
Debian CVElist Bug Report Logs: qemu: CVE-2015-5154: ide: atapi: heap overflow during I/O buffer memory access
Debian Bug report logs - #793811 qemu: CVE-2015-5154: ide: atapi: heap overflow during I/O buffer memory access Package: src:qemu; Maintainer for src:qemu is Debian QEMU Team <pkg-qemu-devel@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Mon, 27 Jul 2015 18:12:02 UTC Severity: g ...
Debian CVElist Bug Report Logs: qemu: CVE-2015-3214: i8254: out-of-bounds memory access in pit_ioport_read function
Debian Bug report logs - #795461 qemu: CVE-2015-3214: i8254: out-of-bounds memory access in pit_ioport_read function Package: src:qemu; Maintainer for src:qemu is Debian QEMU Team <pkg-qemu-devel@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Fri, 14 Aug 2015 08:12:10 UTC Severi ...
Debian CVElist Bug Report Logs: qemu: CVE-2015-5158: scsi stack buffer overflow
Debian Bug report logs - #793388 qemu: CVE-2015-5158: scsi stack buffer overflow Package: src:qemu; Maintainer for src:qemu is Debian QEMU Team <pkg-qemu-devel@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 23 Jul 2015 15:06:03 UTC Severity: important Tags: patch, security, ...
Debian CVElist Bug Report Logs: qemu: CVE-2015-5165: rtl8139 uninitialized heap memory information leakage to guest
Debian Bug report logs - #794610 qemu: CVE-2015-5165: rtl8139 uninitialized heap memory information leakage to guest Package: src:qemu; Maintainer for src:qemu is Debian QEMU Team <pkg-qemu-devel@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 4 Aug 2015 20:24:02 UTC Severi ...
Debian CVElist Bug Report Logs: qemu: CVE-2015-5745: buffer overflow in virtio-serial
Debian Bug report logs - #795087 qemu: CVE-2015-5745: buffer overflow in virtio-serial Package: src:qemu; Maintainer for src:qemu is Debian QEMU Team <pkg-qemu-devel@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Mon, 10 Aug 2015 13:24:06 UTC Severity: normal Tags: fixed-upstrea ...
Debian CVElist Bug Report Logs: qemu: CVE-2015-5225: ui: vnc: heap memory corruption in vnc_refresh_server_surface
Debian Bug report logs - #796465 qemu: CVE-2015-5225: ui: vnc: heap memory corruption in vnc_refresh_server_surface Package: src:qemu; Maintainer for src:qemu is Debian QEMU Team <pkg-qemu-devel@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Fri, 21 Aug 2015 22:12:02 UTC Severit ...
Red Hat: CVE-2015-3214
An out-of-bounds memory access flaw, leading to memory corruption or possibly an information leak, was found in QEMU's pit_ioport_read() function A privileged guest user in a QEMU guest, which had QEMU PIT emulation enabled, could potentially, in rare cases, use this flaw to execute arbitrary code on the host with the privileges of the hosting QEM ...

Exploits

Exploit DB: QEMU - Programmable Interrupt Timer Controller Heap Overflow
Source: codegooglecom/p/google-security-research/issues/detail?id=419#c4 The programmable interrupt timer (PIT) controller in QEMU does not correctly validate the channel number when performing IO writes to the device controller, allowing both an information disclosure and heap-overflow within the context of the host Depending on the l ...

References

CWE-119http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ee73f656a604d5aa9df86a97102e4e462dd79924https://github.com/torvalds/linux/commit/ee73f656a604d5aa9df86a97102e4e462dd79924https://bugzilla.redhat.com/show_bug.cgi?id=1229640http://mirror.linux.org.au/linux/kernel/v2.6/ChangeLog-2.6.33http://www.openwall.com/lists/oss-security/2015/06/25/7https://security.gentoo.org/glsa/201510-02http://www.securityfocus.com/bid/75273https://support.lenovo.com/product_security/qemuhttp://www.securitytracker.com/id/1032598https://support.lenovo.com/us/en/product_security/qemuhttp://rhn.redhat.com/errata/RHSA-2015-1512.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1508.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1507.htmlhttps://www.exploit-db.com/exploits/37990/http://www.debian.org/security/2015/dsa-3348https://www.arista.com/en/support/advisories-notices/security-advisories/1180-security-advisory-13https://www.mail-archive.com/qemu-devel%40nongnu.org/msg304138.htmlhttps://usn.ubuntu.com/2692-1/https://nvd.nist.govhttps://www.exploit-db.com/exploits/37990/https://access.redhat.com/security/cve/cve-2015-3214
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2006-4304CVE-2024-4240arbitrary CVE-2024-31601XSSCVE-2023-20198CVE-2024-4256CVE-2024-3342encryption
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook