CVE-2013-2016

CVE-2013-2016 describes a privilege escalation vulnerability in QEMU versions 1.3.0 and later, specifically affecting the virtio-rng device. A privileged guest user could exploit a flaw in address validation to access the host's QEMU address space, thereby gaining elevated privileges on the host system. This vulnerability carries a high CVSS score of 7.8, indicating a local attack vector with low complexity and high impact on confidentiality, integrity, and availability. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion with 17 mentions.