CVE-2013-2016: debian debian_linux Improper Privilege Management
Vulnerability summary
CVE-2013-2016 is a high (CVSS 7.8) Improper Privilege Management vulnerability in debian debian_linux. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 41.9% of scored vulnerabilities. 3 public exploits are recorded.
Timeline
- 30-12-2019PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
A flaw was found in the way qemu v1.3.0 and later (virtio-rng) validates addresses when guest accesses the config space of a virtio device. If the virtio device has zero/small sized config space, such as virtio-rng, a privileged guest user could use this flaw to access the matching host's qemu address space and thus increase their privileges on the host.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.51%
Chance of exploitation in the next 30 days
Percentile
42%
Versus all other CVEs
30-day change
0.00 pp
From 0.51% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
3 foundExploit Reference (bugzilla.redhat.com)
Maturity: unknown
Exploit Reference (openwall.com)
Maturity: unknown
Exploit Reference (openwall.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian2 products
- qemu< 1.5.0+dfsg-1
- debian_linuxEOL8.0 | 9.0 | 10.0
Novell2 products
- open_desktop_server11.0:sp3
- open_enterprise_server11.0:sp3
Qemu2 products
- qemu≥ 1.3.0, ≤ 1.4.2 | 1.5.0:rc1
- qemu (virtio-rng)v1.3.0 and later
3 vendors · 6 products
References
9 links
- lists.opensuse.org/opensuse-security-announce/2014-05/msg00002.htmlX Refsource MISCMailing ListPatchThird Party Advisory
- www.openwall.com/lists/oss-security/2013/04/29/5X Refsource MISCExploitMailing ListThird Party Advisory
- www.openwall.com/lists/oss-security/2013/04/29/6X Refsource MISCExploitMailing ListThird Party Advisory
- github.com/qemu/qemu/commit/5f5a1318653c08e435cfa52f60b6a712815b659dX Refsource MISCPatchThird Party Advisory