CVE-2016-5105
Qemu: scsi: megasas: stack information leakage while reading configuration
Severity
LowRed Hat Product Security
CVSS 2.0
Review impact separately from score.
Published · May 25, 2016
Updated · November 21, 2025
Description
The megasas_dcmd_cfg_read function in hw/scsi/megasas.c in QEMU, when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, uses an uninitialized variable, which allows local guest administrators to read host memory via vectors involving a MegaRAID Firmware Interface (MFI) command.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 2.0 · 2.3AV:A/AC:M/Au:S/C:P/I:N/A:N
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor