The pit_ioport_read in i8254.c in the Linux kernel before 2.6.33 and QEMU before 2.3.1 does not distinguish between read lengths and write lengths, which might allow guest OS users to execute arbitrary code on the host OS by triggering use of an invalid index.
CVSS Details
- CVSS 3.1 Base Score: 9.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade qemu-kvmUpgrade libcacard-develUpgrade libcacardUpgrade qemu-imgUpgrade qemu-kvm-commonUpgrade qemu-kvm-toolsUpgrade libcacard-tools | Dec 1, 2016 | Aug 31, 2015 |
| Debian | — | Upgrade qemuUpgrade xen | Jul 30, 2024 | Aug 31, 2015 |
| Freebsd | — | Upgrade qemu-user-staticUpgrade qemu-sbrunoUpgrade qemuUpgrade qemu-devel | Dec 10, 2025 | Jan 1, 2016 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | Aug 31, 2015 |
| Oracle_linux | — | Upgrade qemu-kvm-toolsUpgrade qemu-imgUpgrade libcacard-develUpgrade libcacard-toolsUpgrade libcacardUpgrade qemu-kvm-commonUpgrade qemu-kvm | Oct 16, 2024 | Aug 31, 2015 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 16, 2015 |
| Suse | — | Upgrade qemuUpgrade qemu-toolsUpgrade qemu-guest-agentUpgrade qemu-vgabiosUpgrade qemu-langUpgrade qemu-block-curlUpgrade qemu-x86Upgrade qemu-sgabiosUpgrade qemu-ppcUpgrade qemu-s390Upgrade qemu-ipxeUpgrade qemu-block-rbdUpgrade qemu-seabiosUpgrade qemu-kvmUpgrade kvm | Jun 13, 2016 | Aug 31, 2015 |
| Ubuntu | — | Upgrade qemu-system-mipsUpgrade qemu-system-x86Upgrade qemu-system-ppcUpgrade qemu-system-aarch64Upgrade qemu-systemUpgrade qemu-system-miscUpgrade qemu-system-sparcUpgrade qemu-system-arm | Nov 8, 2024 | Aug 31, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub