Vulnerability Details : CVE-2009-3616
Multiple use-after-free vulnerabilities in vnc.c in the VNC server in QEMU 0.10.6 and earlier might allow guest OS users to execute arbitrary code on the host OS by establishing a connection from a VNC client and then (1) disconnecting during data transfer, (2) sending a message using incorrect integer data types, or (3) using the Fuzzy Screen Mode protocol, related to double free vulnerabilities.
Vulnerability category: Memory CorruptionExecute code
Exploit prediction scoring system (EPSS) score for CVE-2009-3616
Probability of exploitation activity in the next 30 days: 0.36%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 71 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2009-3616
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
8.5
|
HIGH | AV:N/AC:M/Au:S/C:C/I:C/A:C |
6.8
|
10.0
|
NIST |
|
9.9
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
3.1
|
6.0
|
NIST |
CWE ids for CVE-2009-3616
-
Assigned by: nvd@nist.gov (Primary)
-
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.Assigned by: nvd@nist.gov (Primary)
References for CVE-2009-3616
-
http://www.openwall.com/lists/oss-security/2009/10/16/8
oss-security - Re: QEMU VNC use-after-freeMailing List;Patch
-
http://marc.info/?l=qemu-devel&m=124324043812915
'Re: [Qemu-devel] [STABLE] [BUG] VNC mode can crash QEMU' - MARCMailing List
-
http://rhn.redhat.com/errata/RHEA-2009-1272.html
RHEA-2009:1272 - Product Enhancement Advisory - Red Hat Customer PortalThird Party Advisory
-
http://www.openwall.com/lists/oss-security/2009/10/16/5
oss-security - QEMU VNC use-after-freeMailing List;Patch
-
http://git.savannah.gnu.org/cgit/qemu.git/commit/?id=753b405331
Broken Link;Exploit
-
https://bugzilla.redhat.com/show_bug.cgi?id=501131
501131 – qemu segfault when VNC client disconnectsIssue Tracking;Patch
-
http://www.securityfocus.com/bid/36716
Broken Link;Third Party Advisory;VDB Entry
-
https://bugzilla.redhat.com/show_bug.cgi?id=505641
505641 – (CVE-2009-3616) CVE-2009-3616 Remote VNC client can cause any QEMU VNC server to crash with a double-freeExploit;Issue Tracking
-
https://bugzilla.redhat.com/show_bug.cgi?id=508567
508567 – Virtual Machine aborts abrupt when executing rdesktop localhost:5900 commandIssue Tracking
-
http://git.savannah.gnu.org/cgit/qemu.git/commit/?id=198a0039c5
Broken Link;Exploit
Products affected by CVE-2009-3616
- cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*