CVE-2016-3710
High
CVE-2016-3710
The VGA module in QEMU improperly performs bounds checking on banked access to video memory, which allows local guest OS administrators to execute arbitrary code on the host by changing access modes after setting the bank register, aka the "Dark Portal" issue.
Exploit probability
0.9%
Published
May 11, 2016
Required by
Not available
Last source change
July 8, 2026
02 / AFFECTED SOFTWARE
Affected packages
106 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
Open Source Vulnerabilities
CVE-2016-3710
View original source
The VGA module in QEMU improperly performs bounds checking on banked access to video memory, which allows local guest OS administrators to execute arbitrary code on the host by changing access modes after setting the bank register, aka the "Dark Portal" issue.
05 / REFERENCES
Further evidence
- http://rhn.redhat.com/errata/RHSA-2016-0724.html
- http://rhn.redhat.com/errata/RHSA-2016-0725.html
- http://rhn.redhat.com/errata/RHSA-2016-0997.html
- http://rhn.redhat.com/errata/RHSA-2016-0999.html
- http://rhn.redhat.com/errata/RHSA-2016-1000.html
- http://rhn.redhat.com/errata/RHSA-2016-1001.html
- http://rhn.redhat.com/errata/RHSA-2016-1002.html
- http://rhn.redhat.com/errata/RHSA-2016-1019.html
- http://rhn.redhat.com/errata/RHSA-2016-1943.html
- http://support.citrix.com/article/CTX212736
- http://www.debian.org/security/2016/dsa-3573
- http://www.openwall.com/lists/oss-security/2016/05/09/3
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- http://www.securityfocus.com/bid/90316
- http://www.securitytracker.com/id/1035794
- http://www.ubuntu.com/usn/USN-2974-1
- http://xenbits.xen.org/xsa/advisory-179.html
- https://access.redhat.com/errata/RHSA-2016:1224
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05164862
- https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg01197.html