What’s Vulnerable › Vulnerabilities
CVE-2016-4020
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2016-05-25 · updated 2026-06-17
Description
The patch_instruction function in hw/i386/kvmvapic.c in QEMU does not initialize the imm32 variable, which allows local guest OS administrators to obtain sensitive information from host stack memory by accessing the Task Priority Register (TPR).
Affected products
- Canonical Ubuntu Linux: 12.04, 14.04, 15.10, 16.04
- Debian Linux: 8.0
- QEMU: through 2.6.2
- RedHat Enterprise Linux Desktop: 7.0
- RedHat Enterprise Linux Eus: 7.4, 7.5, 7.6, 7.7
- RedHat Enterprise Linux Server: 7.0
- RedHat Enterprise Linux Server Aus: 7.4, 7.6, 7.7
- RedHat Enterprise Linux Server Tus: 7.6, 7.7
- RedHat Enterprise Linux Workstation: 7.0
- OpenStack: 6.0, 7.0, 8, 9, 10, 11
- RedHat Virtualization: 4.0
References
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=691a02e2ce0c413236a78dee6f2651c937b09fb0
- http://www.securityfocus.com/bid/86067
- http://www.ubuntu.com/usn/USN-2974-1
- https://access.redhat.com/errata/RHSA-2017:1856
- https://access.redhat.com/errata/RHSA-2017:2392
- https://access.redhat.com/errata/RHSA-2017:2408
- https://bugzilla.redhat.com/show_bug.cgi?id=1313686
- https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-04/msg01106.html
- https://lists.gnu.org/archive/html/qemu-devel/2016-04/msg01118.html
- https://security.gentoo.org/glsa/201609-01
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=691a02e2ce0c413236a78dee6f2651c937b09fb0
Get alerted when CVE-2016-4020 or the next vulnerability affects your stack