PT-2016-5673 · Linux+3 · Linux Kernel+3

David Matlack · Published 2016-05-16 · Updated 2024-06-15 · CVE-2016-3713

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.6.1

Description The issue allows guest OS users to read or write to the kvm arch vcpu data structure, potentially obtaining sensitive information or causing a denial of service (system crash). This can be achieved via a crafted ioctl call.

Recommendations For versions prior to 4.6.1, update to version 4.6.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the msr mtrr valid function in arch/x86/kvm/mtrr.c to minimize the risk of exploitation.

Fix

DoS

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

ALT-PU-2016-1634

ALT-PU-2017-1330

CVE-2016-3713

MGASA-2016-0225

MGASA-2016-0232

MGASA-2016-0233

OPENSUSE-SU-2024:10128-1

USN-2978-1

USN-2978-2

USN-2979-1

USN-2979-2

Affected Products

Alt Linux

Fortios

Linux Kernel

Ubuntu

References · 131

• https://github.com/torvalds/linux/commit/9842df62004f366b9fed2423e24df10542ee0dc5 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10128-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2016-0233 · Vendor Advisory
• https://osv.dev/vulnerability/USN-2979-2 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2016-0225.html · Security Note
• https://osv.dev/vulnerability/MGASA-2016-0232 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-3713 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2016-0225 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-3713 · Security Note
• https://ubuntu.com/security/notices/USN-2978-2 · Vendor Advisory
• https://osv.dev/vulnerability/USN-2979-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-3713 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-0758 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2979-2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-3713 · Vendor Advisory