CVE-2014-5388

critical

Description

Off-by-one error in the pci_read function in the ACPI PCI hotplug interface (hw/acpi/pcihp.c) in QEMU allows local guest users to obtain sensitive information and have other unspecified impact related to a crafted PCI device that triggers memory corruption.

References

Advisories
More

https://lists.gnu.org/archive/html/qemu-devel/2014-08/msg03338.html

https://bugzilla.redhat.com/show_bug.cgi?id=1132956

http://www.ubuntu.com/usn/USN-2409-1

http://seclists.org/oss-sec/2014/q3/440

http://seclists.org/oss-sec/2014/q3/438

http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=fa365d7cd11185237471823a5a33d36765454e16

Details

Source: Mitre, NVD

Published: 2014-11-15

Updated: 2025-04-12

Risk Information

CVSS v2

Base Score: 4.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P

Severity: Medium

CVSS v3

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.00095