CVSS 3.1
6.5 mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:NCVE-2016-4020
The patch_instruction function in hw/i386/kvmvapic.c in QEMU does not initialize the imm32 variable, which allows local guest OS administrators to obtain sensitive information from host stack memory by accessing the Task Priority Register (TPR).
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 31% of CVEs (scores of 2026-10-31)
- Published
- Modified
- Record from
- the NVD, synced
Affected
- canonical:ubuntu_linux
- debian:debian_linux
- qemu:qemu
- redhat:enterprise_linux_desktop
- redhat:enterprise_linux_eus
- redhat:enterprise_linux_server
- redhat:enterprise_linux_server_aus
- redhat:enterprise_linux_server_tus
- redhat:enterprise_linux_workstation
- redhat:openstack
- redhat:virtualization