PT-2016-1710 · Xen+2 · Xen+2

Vitaly Kuznetsov · Publicado 2016-04-15 · Atualizado 2016-11-28 · CVE-2016-3961

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Xen and the Linux kernel versions prior to 4.6

Description The issue arises from insufficient input validation in the Xen hypervisor, allowing a local attacker to cause a denial of service by attempting to access a hugetlbfs mapped area, resulting in a guest OS crash.

Recommendations For Xen and Linux kernel versions prior to 4.6, update to a version that properly suppresses hugetlbfs support in x86 PV guests to prevent the denial of service.

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2016-01036

CVE-2016-3961

DLA-516-1

DSA-3607-1

MGASA-2016-0225

MGASA-2016-0232

MGASA-2016-0233

USN-3001-1

USN-3002-1

USN-3003-1

USN-3004-1

USN-3005-1

USN-3006-1

USN-3007-1

USN-3049-1

USN-3050-1

USN-3127-1

USN-3127-2

Produtos afetados

Linux Kernel

Ubuntu

Xen

Referências · 107

• https://osv.dev/vulnerability/DSA-3607-1 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-3005-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2015-4004 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-4486 · Aviso do Fabricante
• https://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.8 · Nota
• http://kernelnewbies.org/Linux_4.2 · Nota
• https://usn.ubuntu.com/usn/usn-3006-1 · Nota
• https://ubuntu.com/security/notices/USN-3127-2 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=18688 · Nota
• https://ubuntu.com/security/CVE-2016-2117 · Aviso do Fabricante
• http://xenbits.xen.org/xsa/xsa174.patch · Correção
• https://usn.ubuntu.com/usn/usn-3002-1 · Nota
• http://kernelnewbies.org/Linux_4.3 · Nota
• http://kernelnewbies.org/Linux_4.4 · Nota
• https://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.5 · Nota