CVE-2016-1568

A use-after-free flaw was found in the way QEMU's IDE AHCI emulator processed certain AHCI Native Command Queuing (NCQ) AIO commands. A privileged guest user could use this flaw to crash the QEMU process instance or, potentially, execute arbitrary code on the host with privileges of the QEMU process.

The vector of exploit requires to enable TIOCSTI with sysctl, because it is by default disabled since RHEL9 and on. Then, the user would have to be in root terminal, from there the user would have to run a malicious app that would use TIOCSTI to jump out of the child non-root shell back to the parent root shell.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.