CVE-2015-3214: arista eos
Vulnerability summary
CVE-2015-3214 is a medium (CVSS 6.9) vulnerability in arista eos. EPSS estimates a 1.59% chance of exploitation in the next 30 days, higher than 75.7% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 6.9, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 9 · Related 4Timeline
- 31-08-2015PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The pit_ioport_read in i8254.c in the Linux kernel before 2.6.33 and QEMU before 2.3.1 does not distinguish between read lengths and write lengths, which might allow guest OS users to execute arbitrary code on the host OS by triggering use of an invalid index.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
1.59%
Chance of exploitation in the next 30 days
Percentile
76%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.59% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundQEMU - Programmable Interrupt Timer Controller Heap Overflow
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, no authentication (CVSS vector). Other conditions: not stated in public data.
Redhat13 products
- enterprise_linux_compute_node_eus7.1 | 7.2 | 7.3 | 7.4 | 7.5 | 7.6 | 7.7
- enterprise_linux_for_power_big_endian7.0
- enterprise_linux_for_power_big_endian_eus7.1_ppc64 | 7.2_ppc64 | 7.3_ppc64 | 7.4_ppc64 | 7.5_ppc64 | 7.6_ppc64 | 7.7_ppc64
- enterprise_linux_for_scientific_computing7.0
- enterprise_linux_server7.0
Debian3 products
- qemu< 1:2.4+dfsg-1a
- xen< 4.4.0-1
- debian_linuxEOL7.0 | 8.0
Lenovo2 products
- emc_px12-400r_ivx< 1.0.10.33264
- emc_px12-450r_ivx< 1.0.10.33264
Arista1 product
- eos4.12 | 4.13 | 4.14 | 4.15
Linux1 product
- linux_kernel≤ 2.6.32
Qemu1 product
- qemu≤ 2.3.0
Ubuntu1 product
- qemu< 2.0.0+dfsg-2ubuntu1.15
7 vendors · 22 products
References
22 links- security.gentoo.org/glsa/201510-02Vendor AdvisoryX Refsource GENTOOIssue TrackingThird Party Advisory
- github.com/torvalds/linux/commit/ee73f656a604d5aa9df86a97102e4e462dd79924X Refsource CONFIRMPatchThird Party Advisory
www.debian.org/security/2015/dsa-3348Vendor AdvisoryX Refsource DEBIANIssue TrackingThird Party Advisory- rhn.redhat.com/errata/RHSA-2015-1508.htmlVendor AdvisoryX Refsource REDHATIssue TrackingThird Party Advisory
- rhn.redhat.com/errata/RHSA-2015-1507.htmlVendor AdvisoryX Refsource REDHATIssue TrackingThird Party Advisory
Show all 22 references
- www.arista.com/en/support/advisories-notices/security-advisories/1180-security-advisory-13X Refsource MISCThird Party Advisory