CVE-2015-3214

The pit_ioport_read in i8254.c in the Linux kernel before 2.6.33 and QEMU before 2.3.1 does not distinguish between read lengths and write lengths, which might allow guest OS users to execute arbitrary code on the host OS by triggering use of an invalid index.

• CWE-119

• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ee73f656a604d5aa9df86a97102e4e462dd79924Patch, Vendor Advisory
• http://mirror.linux.org.au/linux/kernel/v2.6/ChangeLog-2.6.33Broken Link, Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1507.htmlIssue Tracking, Third Party Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1508.htmlIssue Tracking, Third Party Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1512.htmlThird Party Advisory
• http://www.debian.org/security/2015/dsa-3348Issue Tracking, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/06/25/7Mailing List
• http://www.securityfocus.com/bid/75273Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1032598Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=1229640Issue Tracking
• https://github.com/torvalds/linux/commit/ee73f656a604d5aa9df86a97102e4e462dd79924Patch, Third Party Advisory
• https://security.gentoo.org/glsa/201510-02Issue Tracking, Third Party Advisory
• https://support.lenovo.com/product_security/qemuThird Party Advisory
• https://support.lenovo.com/us/en/product_security/qemuThird Party Advisory
• https://www.arista.com/en/support/advisories-notices/security-advisories/1180-security-advisory-13Third Party Advisory
• https://www.exploit-db.com/exploits/37990/Third Party Advisory, VDB Entry
• https://www.mail-archive.com/qemu-devel%40nongnu.org/msg304138.html
• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ee73f656a604d5aa9df86a97102e4e462dd79924Patch, Vendor Advisory
• http://mirror.linux.org.au/linux/kernel/v2.6/ChangeLog-2.6.33Broken Link, Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1507.htmlIssue Tracking, Third Party Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1508.htmlIssue Tracking, Third Party Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1512.htmlThird Party Advisory
• http://www.debian.org/security/2015/dsa-3348Issue Tracking, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2015/06/25/7Mailing List
• http://www.securityfocus.com/bid/75273Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1032598Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=1229640Issue Tracking
• https://github.com/torvalds/linux/commit/ee73f656a604d5aa9df86a97102e4e462dd79924Patch, Third Party Advisory
• https://security.gentoo.org/glsa/201510-02Issue Tracking, Third Party Advisory
• https://support.lenovo.com/product_security/qemuThird Party Advisory
• https://support.lenovo.com/us/en/product_security/qemuThird Party Advisory
• https://www.arista.com/en/support/advisories-notices/security-advisories/1180-security-advisory-13Third Party Advisory
• https://www.exploit-db.com/exploits/37990/Third Party Advisory, VDB Entry
• https://www.mail-archive.com/qemu-devel%40nongnu.org/msg304138.html

Published

Aug 31, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-3208Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2015-3209Heap-based buffer overflow in the PCNET controller in QEMU a…
• CVE-2015-3210Heap-based buffer overflow in PCRE 8.34 through 8.37 and PCR…9.8
• CVE-2015-3211php-fpm allows local users to write to or create arbitrary f…
• CVE-2015-3212Race condition in net/sctp/socket.c in the Linux kernel befo…
• CVE-2015-3213The gesture handling code in Clutter before 1.16.2 allows ph…
• CVE-2015-3215The NetKVM Windows Virtio driver allows remote attackers to …
• CVE-2015-3216Race condition in a certain Red Hat patch to the PRNG lock i…
• CVE-2015-3217PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle gr…
• CVE-2015-3218The authentication_agent_new function in polkitbackend/polki…
• CVE-2015-3219Cross-site scripting (XSS) vulnerability in the Orchestratio…
• CVE-2015-3220The tlslite library before 0.4.9 for Python allows remote at…