{"id":"CVE-2016-3710","details":"The VGA module in QEMU improperly performs bounds checking on banked access to video memory, which allows local guest OS administrators to execute arbitrary code on the host by changing access modes after setting the bank register, aka the \"Dark Portal\" issue.","modified":"2026-04-10T03:51:03.563365Z","published":"2016-05-11T21:59:01.077Z","related":["MGASA-2016-0176","MGASA-2017-0012","SUSE-SU-2016:1560-1","SUSE-SU-2016:1698-1","SUSE-SU-2016:1703-1","SUSE-SU-2016:1785-1","SUSE-SU-2016:2093-1","SUSE-SU-2016:2100-1","SUSE-SU-2016:2528-1","SUSE-SU-2016:2533-1","SUSE-SU-2016:2725-1"],"references":[{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2016-0725.html"},{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2016-0999.html"},{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2016-1002.html"},{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2016-1019.html"},{"type":"ADVISORY","url":"http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html"},{"type":"ADVISORY","url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05164862"},{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2016-0724.html"},{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2016-0997.html"},{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2016-1001.html"},{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2016-1943.html"},{"type":"ADVISORY","url":"http://www.openwall.com/lists/oss-security/2016/05/09/3"},{"type":"ADVISORY","url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2016:1224"},{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2016-1000.html"},{"type":"ADVISORY","url":"http://www.debian.org/security/2016/dsa-3573"},{"type":"ADVISORY","url":"http://xenbits.xen.org/xsa/advisory-179.html"},{"type":"ADVISORY","url":"http://support.citrix.com/article/CTX212736"},{"type":"ADVISORY","url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html"},{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/90316"},{"type":"ADVISORY","url":"http://www.securitytracker.com/id/1035794"},{"type":"ADVISORY","url":"http://www.ubuntu.com/usn/USN-2974-1"},{"type":"FIX","url":"https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg01197.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/qemu/qemu","events":[{"introduced":"0"},{"last_affected":"c1eb2ddf0f8075faddc5f7c3d39feae3e8e9d6b4"},{"introduced":"0"},{"last_affected":"a9e8aeb3755bccb7b51174adcf4a3fc427e0d147"},{"introduced":"0"},{"last_affected":"541bbb07eb197a870661ed702ae1f15c7d46aea6"},{"introduced":"0"},{"last_affected":"562d6b4f7f7ee39a4ce81ed3605e2fb4546af262"},{"introduced":"0"},{"last_affected":"a58047f7fbb055677e45c9a7d65ba40fbfad4b92"},{"introduced":"0"},{"last_affected":"9370a3bbc478f623dd21d783560629ea2064625b"},{"introduced":"0"},{"last_affected":"7acbff99c6c285b3070bf0e768d56f511e2bf346"},{"introduced":"0"},{"last_affected":"bc8995cafa0c36b9e4be682e9a60d59484b33500"},{"introduced":"0"},{"last_affected":"8d0d9b9f67d6bdee9eaec1e8c1222ad91dc4ac01"},{"introduced":"0"},{"last_affected":"975eb6a547f809608ccb08c221552f666611af25"},{"introduced":"0"},{"last_affected":"823a3f11fb8f04c3c3cc0f95f968fef1bfc6534f"},{"introduced":"0"},{"last_affected":"fdd76fecdde1ad444ff4deb7f1c4f7e4a1ef97d6"},{"introduced":"0"},{"last_affected":"609d7596524ab204ccd71ef42c9eee4c7c338ea4"},{"introduced":"0"},{"last_affected":"823a3f11fb8f04c3c3cc0f95f968fef1bfc6534f"},{"introduced":"0"},{"last_affected":"38441756b70eec5807b5f60dad11a93a91199866"},{"introduced":"0"},{"last_affected":"609d7596524ab204ccd71ef42c9eee4c7c338ea4"},{"introduced":"0"},{"last_affected":"823a3f11fb8f04c3c3cc0f95f968fef1bfc6534f"},{"introduced":"0"},{"last_affected":"609d7596524ab204ccd71ef42c9eee4c7c338ea4"},{"introduced":"0"},{"last_affected":"823a3f11fb8f04c3c3cc0f95f968fef1bfc6534f"},{"introduced":"0"},{"last_affected":"b67b00e6b4c7831a3f5bc684bc0df7a9bfd1bd56"},{"introduced":"0"},{"last_affected":"b67b00e6b4c7831a3f5bc684bc0df7a9bfd1bd56"},{"introduced":"0"},{"last_affected":"b67b00e6b4c7831a3f5bc684bc0df7a9bfd1bd56"},{"introduced":"0"},{"last_affected":"609d7596524ab204ccd71ef42c9eee4c7c338ea4"},{"introduced":"0"},{"last_affected":"823a3f11fb8f04c3c3cc0f95f968fef1bfc6534f"}],"database_specific":{"versions":[{"introduced":"0"},{"last_affected":"8.0"},{"introduced":"0"},{"last_affected":"2.0.0"},{"introduced":"0"},{"last_affected":"2.1.0"},{"introduced":"0"},{"last_affected":"2.1.2"},{"introduced":"0"},{"last_affected":"2.5.1"},{"introduced":"0"},{"last_affected":"2.6.0-rc0"},{"introduced":"0"},{"last_affected":"2.6.0-rc1"},{"introduced":"0"},{"last_affected":"2.6.0-rc2"},{"introduced":"0"},{"last_affected":"2.6.0-rc3"},{"introduced":"0"},{"last_affected":"2.6.0-rc4"},{"introduced":"0"},{"last_affected":"7.0"},{"introduced":"0"},{"last_affected":"5.0"},{"introduced":"0"},{"last_affected":"6.0"},{"introduced":"0"},{"last_affected":"7.0"},{"introduced":"0"},{"last_affected":"3.0"},{"introduced":"0"},{"last_affected":"6.0"},{"introduced":"0"},{"last_affected":"7.0"},{"introduced":"0"},{"last_affected":"6.0"},{"introduced":"0"},{"last_affected":"7.0"},{"introduced":"0"},{"last_affected":"7.2"},{"introduced":"0"},{"last_affected":"7.2"},{"introduced":"0"},{"last_affected":"7.2"},{"introduced":"0"},{"last_affected":"6.0"},{"introduced":"0"},{"last_affected":"7.0"}]}}],"versions":["v0.1.0","v0.1.1","v0.1.3","v0.1.4","v0.1.5","v0.1.6","v0.11.0-rc0","v0.12.0-rc0","v0.13.0-rc0","v0.14.0-rc0","v0.2.0","v0.3.0","v0.4.0","v0.4.1","v0.4.2","v0.4.3","v0.4.4","v0.5.0","v1.0","v1.0-rc0","v1.0-rc1","v1.0-rc2","v1.0-rc3","v1.0-rc4","v1.1-rc0","v1.1-rc1","v1.1-rc2","v1.1.0","v1.1.0-rc2","v1.1.0-rc3","v1.1.0-rc4","v1.2.0","v1.2.0-rc0","v1.2.0-rc1","v1.2.0-rc2","v1.2.0-rc3","v1.3.0","v1.3.0-rc0","v1.3.0-rc1","v1.3.0-rc2","v1.4.0","v1.4.0-rc0","v1.4.0-rc1","v1.4.0-rc2","v1.5.0","v1.5.0-rc0","v1.5.0-rc1","v1.5.0-rc2","v1.5.0-rc3","v1.6.0","v1.6.0-rc0","v1.6.0-rc1","v1.6.0-rc2","v1.6.0-rc3","v1.7.0","v1.7.0-rc0","v1.7.0-rc1","v1.7.0-rc2","v2.0.0","v2.0.0-rc0","v2.0.0-rc1","v2.0.0-rc2","v2.0.0-rc3","v2.1.0","v2.1.0-rc0","v2.1.0-rc1","v2.1.0-rc2","v2.1.0-rc3","v2.1.0-rc4","v2.1.0-rc5","v2.1.1","v2.1.2","v2.10.0","v2.10.0-rc0","v2.10.0-rc1","v2.10.0-rc2","v2.10.0-rc3","v2.10.0-rc4","v2.11.0","v2.11.0-rc0","v2.11.0-rc1","v2.11.0-rc2","v2.11.0-rc3","v2.11.0-rc4","v2.11.0-rc5","v2.12.0","v2.12.0-rc0","v2.12.0-rc1","v2.12.0-rc2","v2.12.0-rc3","v2.12.0-rc4","v2.2.0","v2.2.0-rc0","v2.2.0-rc1","v2.2.0-rc2","v2.2.0-rc3","v2.2.0-rc4","v2.2.0-rc5","v2.3.0","v2.3.0-rc0","v2.3.0-rc1","v2.3.0-rc2","v2.3.0-rc3","v2.3.0-rc4","v2.4.0","v2.4.0-rc0","v2.4.0-rc1","v2.4.0-rc2","v2.4.0-rc3","v2.4.0-rc4","v2.5.0","v2.5.0-rc0","v2.5.0-rc1","v2.5.0-rc2","v2.5.0-rc3","v2.5.0-rc4","v2.5.1","v2.6.0","v2.6.0-rc0","v2.6.0-rc1","v2.6.0-rc2","v2.6.0-rc3","v2.6.0-rc4","v2.6.0-rc5","v2.7.0","v2.7.0-rc0","v2.7.0-rc1","v2.7.0-rc2","v2.7.0-rc3","v2.7.0-rc4","v2.7.0-rc5","v2.8.0","v2.8.0-rc0","v2.8.0-rc1","v2.8.0-rc2","v2.8.0-rc3","v2.8.0-rc4","v2.9.0","v2.9.0-rc0","v2.9.0-rc1","v2.9.0-rc2","v2.9.0-rc3","v2.9.0-rc4","v2.9.0-rc5","v3.0.0","v3.0.0-rc0","v3.0.0-rc1","v3.0.0-rc2","v3.0.0-rc3","v3.0.0-rc4","v3.1.0","v3.1.0-rc0","v3.1.0-rc1","v3.1.0-rc2","v3.1.0-rc3","v3.1.0-rc4","v3.1.0-rc5","v4.0.0","v4.0.0-rc0","v4.0.0-rc1","v4.0.0-rc2","v4.0.0-rc3","v4.0.0-rc4","v4.1.0","v4.1.0-rc0","v4.1.0-rc1","v4.1.0-rc2","v4.1.0-rc3","v4.1.0-rc4","v4.1.0-rc5","v4.2.0","v4.2.0-rc0","v4.2.0-rc1","v4.2.0-rc2","v4.2.0-rc3","v4.2.0-rc4","v4.2.0-rc5","v5.0.0","v5.0.0-rc0","v5.0.0-rc1","v5.0.0-rc2","v5.0.0-rc3","v5.0.0-rc4","v5.1.0","v5.1.0-rc0","v5.1.0-rc1","v5.1.0-rc2","v5.1.0-rc3","v5.2.0","v5.2.0-rc0","v5.2.0-rc1","v5.2.0-rc2","v5.2.0-rc3","v5.2.0-rc4","v6.0.0","v6.0.0-rc0","v6.0.0-rc1","v6.0.0-rc2","v6.0.0-rc3","v6.0.0-rc4","v6.0.0-rc5","v6.1.0","v6.1.0-rc0","v6.1.0-rc1","v6.1.0-rc2","v6.1.0-rc3","v6.1.0-rc4","v6.2.0","v6.2.0-rc0","v6.2.0-rc1","v6.2.0-rc3","v6.2.0-rc4","v7.0.0","v7.0.0-rc0","v7.0.0-rc1","v7.0.0-rc2","v7.0.0-rc3","v7.0.0-rc4","v7.1.0","v7.1.0-rc0","v7.1.0-rc1","v7.1.0-rc2","v7.1.0-rc3","v7.1.0-rc4","v7.2.0","v7.2.0-rc0","v7.2.0-rc1","v7.2.0-rc2","v7.2.0-rc3","v7.2.0-rc4","v8.0.0","v8.0.0-rc0","v8.0.0-rc1","v8.0.0-rc2","v8.0.0-rc3","v8.0.0-rc4"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-3710.json","unresolved_ranges":[{"events":[{"introduced":"0"},{"last_affected":"2.1.4"}]},{"events":[{"introduced":"0"},{"last_affected":"12.04"}]},{"events":[{"introduced":"0"},{"last_affected":"14.04"}]},{"events":[{"introduced":"0"},{"last_affected":"15.10"}]},{"events":[{"introduced":"0"},{"last_affected":"16.04"}]},{"events":[{"introduced":"0"},{"last_affected":"3.2"}]},{"events":[{"introduced":"0"},{"last_affected":"3.3"}]},{"events":[{"introduced":"0"},{"last_affected":"3.4"}]},{"events":[{"introduced":"0"},{"last_affected":"5-NA"}]},{"events":[{"introduced":"0"},{"last_affected":"6-NA"}]},{"events":[{"introduced":"0"},{"last_affected":"7-NA"}]},{"events":[{"introduced":"0"},{"last_affected":"8"}]},{"events":[{"introduced":"0"},{"last_affected":"7.3"}]},{"events":[{"introduced":"0"},{"last_affected":"7.4"}]},{"events":[{"introduced":"0"},{"last_affected":"7.6"}]},{"events":[{"introduced":"0"},{"last_affected":"7.3"}]},{"events":[{"introduced":"0"},{"last_affected":"7.4"}]},{"events":[{"introduced":"0"},{"last_affected":"7.5"}]},{"events":[{"introduced":"0"},{"last_affected":"7.6"}]},{"events":[{"introduced":"0"},{"last_affected":"7.7"}]},{"events":[{"introduced":"0"},{"last_affected":"7.3"}]},{"events":[{"introduced":"0"},{"last_affected":"7.6"}]},{"events":[{"introduced":"0"},{"last_affected":"7.7"}]}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}