Read the docs
TI-2016-03140 Aliases CVE-2016-3710GHSA-p6hq-65m2-r4jg

The VGA module in QEMU improperly performs bounds checking on banked access to video…

Priority MEDIUM 40CWE-119Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 20 fixed, 4 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-119 and the CVSS impact.

Summary

The VGA module in QEMU improperly performs bounds checking on banked access to video memory, which allows local guest OS administrators to execute arbitrary code on the host by changing access modes after setting the bank register, aka the "Dark Portal" issue.

Why it matters now

EPSS 0.00916 60th percentileScored 2026-11-07
Fix Partial Red Hat: 10 advisoriesRed Hat: 20 fixed, 4 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 47

CPEVersionsRoleVendor
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
cpe:2.3:a:hp:helion_openstack:2.0.0:*:*:*:*:*:*:*2.0.0VulnerableHewlett Packard Enterprise
cpe:2.3:a:hp:helion_openstack:2.1.0:*:*:*:*:*:*:*2.1.0VulnerableHewlett Packard Enterprise
cpe:2.3:a:hp:helion_openstack:2.1.2:*:*:*:*:*:*:*2.1.2VulnerableHewlett Packard Enterprise
cpe:2.3:a:hp:helion_openstack:2.1.4:*:*:*:*:*:*:*2.1.4VulnerableHewlett Packard Enterprise
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*12.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*14.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*15.10VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*16.04VulnerableCanonical
cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*up to 2.5.1VulnerableQEMU
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
  • cpe:2.3:a:hp:helion_openstack:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·Hewlett Packard Enterprise
  • cpe:2.3:a:hp:helion_openstack:2.1.0:*:*:*:*:*:*:* Versions 2.1.0 Vulnerable ·Hewlett Packard Enterprise
  • cpe:2.3:a:hp:helion_openstack:2.1.2:*:*:*:*:*:*:* Versions 2.1.2 Vulnerable ·Hewlett Packard Enterprise
  • cpe:2.3:a:hp:helion_openstack:2.1.4:*:*:*:*:*:*:* Versions 2.1.4 Vulnerable ·Hewlett Packard Enterprise
  • cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:* Versions 12.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* Versions 14.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:* Versions 15.10 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
  • cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:* Versions up to 2.5.1 Vulnerable ·QEMU
Show 37 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:qemu:qemu:2.6.0:rc0:*:*:*:*:*:*2.6.0 rc0VulnerableQEMU
cpe:2.3:a:qemu:qemu:2.6.0:rc1:*:*:*:*:*:*2.6.0 rc1VulnerableQEMU
cpe:2.3:a:qemu:qemu:2.6.0:rc2:*:*:*:*:*:*2.6.0 rc2VulnerableQEMU
cpe:2.3:a:qemu:qemu:2.6.0:rc3:*:*:*:*:*:*2.6.0 rc3VulnerableQEMU
cpe:2.3:a:qemu:qemu:2.6.0:rc4:*:*:*:*:*:*2.6.0 rc4VulnerableQEMU
cpe:2.3:a:oracle:vm_server:3.2:*:*:*:*:*:x86:*3.2VulnerableOracle
cpe:2.3:a:oracle:vm_server:3.3:*:*:*:*:*:x86:*3.3VulnerableOracle
cpe:2.3:a:oracle:vm_server:3.4:*:*:*:*:*:x86:*3.4VulnerableOracle
cpe:2.3:o:oracle:linux:5:-:*:*:*:*:*:*5VulnerableOracle
cpe:2.3:o:oracle:linux:6:-:*:*:*:*:*:*6VulnerableOracle
cpe:2.3:o:oracle:linux:7:-:*:*:*:*:*:*7VulnerableOracle
cpe:2.3:a:citrix:xenserver:*:*:*:*:*:*:*:*up to 7.0VulnerableCitrix
cpe:2.3:a:redhat:openstack:5.0:*:*:*:*:*:*:*5.0VulnerableRed Hat
cpe:2.3:a:redhat:openstack:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:a:redhat:openstack:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:a:redhat:openstack:8:*:*:*:*:*:*:*8VulnerableRed Hat
cpe:2.3:a:redhat:virtualization:3.0:*:*:*:*:*:*:*3.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:*7.2VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*7.3VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*7.4VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*7.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.2:*:*:*:*:*:*:*7.2VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:*:*:*:*:*:*:*7.3VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*7.4VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*7.5VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*7.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.7:*:*:*:*:*:*:*7.7VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.2:*:*:*:*:*:*:*7.2VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*7.3VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*7.6VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*7.7VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
  • cpe:2.3:a:qemu:qemu:2.6.0:rc0:*:*:*:*:*:* Versions 2.6.0 rc0 Vulnerable ·QEMU
  • cpe:2.3:a:qemu:qemu:2.6.0:rc1:*:*:*:*:*:* Versions 2.6.0 rc1 Vulnerable ·QEMU
  • cpe:2.3:a:qemu:qemu:2.6.0:rc2:*:*:*:*:*:* Versions 2.6.0 rc2 Vulnerable ·QEMU
  • cpe:2.3:a:qemu:qemu:2.6.0:rc3:*:*:*:*:*:* Versions 2.6.0 rc3 Vulnerable ·QEMU
  • cpe:2.3:a:qemu:qemu:2.6.0:rc4:*:*:*:*:*:* Versions 2.6.0 rc4 Vulnerable ·QEMU
  • cpe:2.3:a:oracle:vm_server:3.2:*:*:*:*:*:x86:* Versions 3.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:vm_server:3.3:*:*:*:*:*:x86:* Versions 3.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:vm_server:3.4:*:*:*:*:*:x86:* Versions 3.4 Vulnerable ·Oracle
  • cpe:2.3:o:oracle:linux:5:-:*:*:*:*:*:* Versions 5 Vulnerable ·Oracle
  • cpe:2.3:o:oracle:linux:6:-:*:*:*:*:*:* Versions 6 Vulnerable ·Oracle
  • cpe:2.3:o:oracle:linux:7:-:*:*:*:*:*:* Versions 7 Vulnerable ·Oracle
  • cpe:2.3:a:citrix:xenserver:*:*:*:*:*:*:*:* Versions up to 7.0 Vulnerable ·Citrix
  • cpe:2.3:a:redhat:openstack:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openstack:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openstack:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openstack:8:*:*:*:*:*:*:* Versions 8 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:virtualization:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:* Versions 7.2 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:* Versions 7.3 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:* Versions 7.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_eus:7.2:*:*:*:*:*:*:* Versions 7.2 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:*:*:*:*:*:*:* Versions 7.3 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:* Versions 7.4 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:* Versions 7.5 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:* Versions 7.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_eus:7.7:*:*:*:*:*:*:* Versions 7.7 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_tus:7.2:*:*:*:*:*:*:* Versions 7.2 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:* Versions 7.3 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:* Versions 7.6 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:* Versions 7.7 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat

Remediation

Red Hat 10 advisories

  • RHSA-2016:1943 Released 2016-09-27 · Red Hat rating Important
    kvm security update
    • Red Hat Enterprise Linux Desktop Multi OS (v. 5 client) kmod-kvm-83-276.el5_11, kmod-kvm-debug-83-276.el5_11, kvm-83-276.el5_11 +2
    • Red Hat Enterprise Linux Virtualization (v. 5 server) kmod-kvm-83-276.el5_11, kmod-kvm-debug-83-276.el5_11, kvm-83-276.el5_11 +2
  • RHSA-2016:1224 Released 2016-06-13 · Red Hat rating Important
    qemu-kvm-rhev security update
    • RHEV Agents (vdsm) qemu-img-rhev-2:0.12.1.2-2.479.el6_7.5, qemu-kvm-rhev-2:0.12.1.2-2.479.el6_7.5, qemu-kvm-rhev-tools-2:0.12.1.2-2.479.el6_7.5
  • RHSA-2016:1019 Released 2016-05-11 · Red Hat rating Important
    qemu-kvm-rhev security update
    • Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6 qemu-img-rhev-2:0.12.1.2-2.491.el6_8.1, qemu-kvm-rhev-2:0.12.1.2-2.491.el6_8.1, qemu-kvm-rhev-tools-2:0.12.1.2-2.491.el6_8.1
Show 7 more Red Hat advisories
  • RHSA-2016:1000 Released 2016-05-10 · Red Hat rating Important
    qemu-kvm-rhev security update
    • Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7 libcacard-devel-rhev-10:2.3.0-31.el7_2.13, libcacard-rhev-10:2.3.0-31.el7_2.13, libcacard-tools-rhev-10:2.3.0-31.el7_2.13 +4
  • RHSA-2016:1001 Released 2016-05-10 · Red Hat rating Important
    qemu-kvm-rhev security update
    • Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 libcacard-rhev-10:2.3.0-31.el7_2.13, libcacard-tools-rhev-10:2.3.0-31.el7_2.13, qemu-img-rhev-10:2.3.0-31.el7_2.13 +3
  • RHSA-2016:1002 Released 2016-05-10 · Red Hat rating Important
    qemu-kvm-rhev security update
    • Red Hat OpenStack Platform 8.0 (Liberty) libcacard-rhev-10:2.3.0-31.el7_2.13, libcacard-tools-rhev-10:2.3.0-31.el7_2.13, qemu-img-rhev-10:2.3.0-31.el7_2.13 +3
  • RHSA-2016:0999 Released 2016-05-10 · Red Hat rating Important
    qemu-kvm-rhev security update
    • Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7 libcacard-devel-rhev-10:2.3.0-31.el7_2.13, libcacard-rhev-10:2.3.0-31.el7_2.13, libcacard-tools-rhev-10:2.3.0-31.el7_2.13 +4
  • RHSA-2016:0997 Released 2016-05-10 · Red Hat rating Important
    qemu-kvm security update
    • Red Hat Enterprise Linux Desktop (v. 6) qemu-guest-agent-2:0.12.1.2-2.491.el6_8.1, qemu-img-2:0.12.1.2-2.491.el6_8.1, qemu-kvm-2:0.12.1.2-2.491.el6_8.1 +1
    • Red Hat Enterprise Linux HPC Node (v. 6) qemu-guest-agent-2:0.12.1.2-2.491.el6_8.1, qemu-img-2:0.12.1.2-2.491.el6_8.1, qemu-kvm-2:0.12.1.2-2.491.el6_8.1 +1
    • Red Hat Enterprise Linux Server (v. 6) qemu-guest-agent-2:0.12.1.2-2.491.el6_8.1, qemu-img-2:0.12.1.2-2.491.el6_8.1, qemu-kvm-2:0.12.1.2-2.491.el6_8.1 +1
    • Red Hat Enterprise Linux Workstation (v. 6) qemu-guest-agent-2:0.12.1.2-2.491.el6_8.1, qemu-img-2:0.12.1.2-2.491.el6_8.1, qemu-kvm-2:0.12.1.2-2.491.el6_8.1 +1
  • RHSA-2016:0724 Released 2016-05-09 · Red Hat rating Important
    qemu-kvm security update
    • Red Hat Enterprise Linux Client (v. 7) libcacard-10:1.5.3-105.el7_2.4, qemu-img-10:1.5.3-105.el7_2.4, qemu-kvm-10:1.5.3-105.el7_2.4 +2
    • Red Hat Enterprise Linux Client Optional (v. 7) libcacard-devel-10:1.5.3-105.el7_2.4, libcacard-tools-10:1.5.3-105.el7_2.4
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) libcacard-10:1.5.3-105.el7_2.4, libcacard-devel-10:1.5.3-105.el7_2.4, libcacard-tools-10:1.5.3-105.el7_2.4 +4
    • Red Hat Enterprise Linux Server (v. 7) libcacard-10:1.5.3-105.el7_2.4, qemu-img-10:1.5.3-105.el7_2.4, qemu-kvm-10:1.5.3-105.el7_2.4 +2
    • Red Hat Enterprise Linux Server Optional (v. 7) libcacard-10:1.5.3-105.el7_2.4, libcacard-10:1.5.3-105.el7_2.4.ppc, libcacard-devel-10:1.5.3-105.el7_2.4 +2
    • Red Hat Enterprise Linux Workstation (v. 7) libcacard-10:1.5.3-105.el7_2.4, qemu-img-10:1.5.3-105.el7_2.4, qemu-kvm-10:1.5.3-105.el7_2.4 +2
    • Red Hat Enterprise Linux Workstation Optional (v. 7) libcacard-devel-10:1.5.3-105.el7_2.4, libcacard-tools-10:1.5.3-105.el7_2.4
  • RHSA-2016:0725 Released 2016-05-09 · Red Hat rating Important
    qemu-kvm-rhev security update
    • RHEV-H and VDSM for 7 Hosts libcacard-devel-rhev-10:2.3.0-31.el7_2.13, libcacard-rhev-10:2.3.0-31.el7_2.13, libcacard-tools-rhev-10:2.3.0-31.el7_2.13 +4

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 5AffectedNo fix yet
Red Hat Enterprise Linux 6AffectedNo fix yet
Red Hat Enterprise Linux 7AffectedNo fix yet
Red Hat OpenStack Platform 9 (Mitaka)AffectedNo fix yet
RHEV Agents (vdsm)Fixed RHSA-2016:1224
RHEV-H and VDSM for 7 HostsFixed RHSA-2016:0725
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2016:0724
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2016:0724
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2016:0724
Red Hat Enterprise Linux Desktop (v. 6)Fixed RHSA-2016:0997
Red Hat Enterprise Linux Desktop Multi OS (v. 5 client)Fixed RHSA-2016:1943
Red Hat Enterprise Linux HPC Node (v. 6)Fixed RHSA-2016:0997
Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6Fixed RHSA-2016:1019
Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7Fixed RHSA-2016:0999
Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7Fixed RHSA-2016:1000
Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7Fixed RHSA-2016:1001
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2016:0997
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2016:0724
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2016:0724
Red Hat Enterprise Linux Virtualization (v. 5 server)Fixed RHSA-2016:1943
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2016:0997
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2016:0724
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2016:0724
Red Hat OpenStack Platform 8.0 (Liberty)Fixed RHSA-2016:1002

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-3710
  2. 2026-10-03 Alias added: GHSA-p6hq-65m2-r4jg

References

Patch 1

Advisory 19

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences