CVE-2016-10028

What it actually does

The flaw in the Virtio GPU emulator allows a local guest OS user to trigger an out-of-bounds read and process crash by issuing a VIRTIO_GPU_CMD_GET_CAPSET command with a capabilities size value of 0.

Why it matters to the business

Successful exploitation results in denial of service that can interrupt virtualized workloads and messaging services built on the affected RabbitMQ topology operator packages, with low but persistent risk given the stable low exploit probability over years since disclosure.

How an attack unfolds

An attacker who has obtained local access inside a guest virtual machine constructs and sends a VIRTIO_GPU_CMD_GET_CAPSET command specifying a maximum capabilities size of zero, causing the emulator code in hw/display/virtio-gpu-3d.c to perform an out-of-bounds read that crashes the QEMU process.

How to fix it

Upgrade rabbitmq-messaging-topology-operator and rabbitmq-messaging-topology-operator-compat packages on both Chainguard and Wolfi to version 1.14.1-r2 or later.

How to confirm the fix worked

Confirm installed package versions match or exceed the listed fixed releases and verify that the vulnerable code path in virtio-gpu-3d.c is no longer present after the update.

Typical attack path

1. Obtain local access inside a guest virtual machine
2. Issue VIRTIO_GPU_CMD_GET_CAPSET command with capabilities size set to zero
3. Trigger out-of-bounds read leading to process crash

How to detect it

Inspect QEMU or virtio-gpu process crash logs and look for repeated VIRTIO_GPU_CMD_GET_CAPSET commands originating from guest operating systems.

What your security team should do

• Apply the listed package upgrades to 1.14.1-r2 across all environments without delay
• Review virtual machine configurations to limit exposure of Virtio GPU devices where feasible
• Monitor guest-initiated GPU capability queries in virtualization logs