CVE-2016-4020

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The patch_instruction function in hw/i386/kvmvapic.c in QEMU does not initialize the imm32 variable, which allows local guest OS administrators to obtain sensitive information from host stack memory by accessing the Task Priority Register (TPR).

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=691a02e2ce0c413236a78dee6f2651c937b09fb0
http://www.securityfocus.com/bid/86067Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-2974-1Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1856Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2392Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2408Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1313686Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/11/msg00038.htmlMailing List, Third Party Advisory
https://lists.gnu.org/archive/html/qemu-devel/2016-04/msg01106.htmlPatch, Third Party Advisory
https://lists.gnu.org/archive/html/qemu-devel/2016-04/msg01118.htmlPatch, Third Party Advisory
https://security.gentoo.org/glsa/201609-01Third Party Advisory
http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=691a02e2ce0c413236a78dee6f2651c937b09fb0
http://www.securityfocus.com/bid/86067Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-2974-1Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1856Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2392Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2408Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1313686Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/11/msg00038.htmlMailing List, Third Party Advisory
https://lists.gnu.org/archive/html/qemu-devel/2016-04/msg01106.htmlPatch, Third Party Advisory
https://lists.gnu.org/archive/html/qemu-devel/2016-04/msg01118.htmlPatch, Third Party Advisory
https://security.gentoo.org/glsa/201609-01Third Party Advisory

Timeline

Published: May 25, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-40217.5The read_binary function in buffer.c in pgpdump before 0.30 allows context-dependent attackers to cause a denial of service (infinite loop a CVE-2016-40249.8Integer overflow in imlib2 before 1.4.9 on 32-bit platforms allows remote attackers to execute arbitrary code via large dimensions in an ima CVE-2016-40255.5Avast Internet Security v11.x.x, Pro Antivirus v11.x.x, Premier v11.x.x, Free Antivirus v11.x.x, Business Security v11.x.x, Endpoint Protect CVE-2016-40266.1An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11. The content sanitizer component has an issue with filtering malicio CVE-2016-40273.5An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev10. App Suite frontend offers to control whether a user wants to store CVE-2016-40287.5An issue was discovered in Open-Xchange OX Guard before 2.4.0-rev8. OX Guard uses an authentication token to identify and transfer guest use CVE-2016-40298.6WordPress before 4.5 does not consider octal and hexadecimal IP address formats when determining an intranet address, which allows remote at CVE-2016-40306.8Samsung SM-G920F build G920FXXU2COH2 (Galaxy S6), SM-N9005 build N9005XXUGBOK6 (Galaxy Note 3), GT-I9192 build I9192XXUBNB1 (Galaxy S4 mini)CVE-2016-40316.8Samsung SM-G920F build G920FXXU2COH2 (Galaxy S6), SM-N9005 build N9005XXUGBOK6 (Galaxy Note 3), GT-I9192 build I9192XXUBNB1 (Galaxy S4 mini)CVE-2016-40324.6Samsung SM-G920F build G920FXXU2COH2 (Galaxy S6), SM-N9005 build N9005XXUGBOK6 (Galaxy Note 3), GT-I9192 build I9192XXUBNB1 (Galaxy S4 mini)CVE-2016-40365.5The quagga package before 0.99.23-2.6.1 in openSUSE and SUSE Linux Enterprise Server 11 SP 1 uses weak permissions for /etc/quagga, which al CVE-2016-40376.0The ehci_advance_state function in hw/usb/hcd-ehci.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loo