The pit_ioport_read in i8254.c in the Linux kernel before 2.6.33 and QEMU before 2.3.1 does not distinguish between read lengths and write lengths, which might allow guest OS users to execute arbitrary code on the host OS by triggering use of an invalid index.
CVSS Details
- CVSS 3.1 Base Score: 9.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade qemu-imgUpgrade libcacard-toolsUpgrade qemu-kvm-toolsUpgrade qemu-kvm-commonUpgrade libcacard-develUpgrade libcacardUpgrade qemu-kvm | Dec 1, 2016 | Aug 31, 2015 |
| Debian | — | Upgrade qemuUpgrade xen | Jul 30, 2024 | Aug 31, 2015 |
| Freebsd | — | Upgrade qemu-sbrunoUpgrade qemu-user-staticUpgrade qemu-develUpgrade qemu | Dec 10, 2025 | Jan 1, 2016 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | Aug 31, 2015 |
| Oracle_linux | — | Upgrade qemu-imgUpgrade qemu-kvm-toolsUpgrade libcacardUpgrade qemu-kvmUpgrade libcacard-toolsUpgrade libcacard-develUpgrade qemu-kvm-common | Oct 16, 2024 | Aug 31, 2015 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 16, 2015 |
| Suse | — | Upgrade qemuUpgrade qemu-vgabiosUpgrade qemu-x86Upgrade qemu-sgabiosUpgrade qemu-block-curlUpgrade qemu-toolsUpgrade qemu-guest-agentUpgrade qemu-langUpgrade qemu-ppcUpgrade qemu-kvmUpgrade qemu-block-rbdUpgrade qemu-seabiosUpgrade qemu-ipxeUpgrade kvmUpgrade qemu-s390 | Jun 13, 2016 | Aug 31, 2015 |
| Ubuntu | — | Upgrade qemu-system-aarch64Upgrade qemu-system-miscUpgrade qemu-system-ppcUpgrade qemu-systemUpgrade qemu-system-mipsUpgrade qemu-system-x86Upgrade qemu-system-armUpgrade qemu-system-sparc | Nov 8, 2024 | Aug 31, 2015 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub