CVE-2016-10150: Use After Free
Last updated 24 July 2024
Other sources
Linux kernel built with the Kernel-based Virtual Machine(CONFIGKVM) support is vulnerable to a use-after-free flaw. It could occur while creating devices, via ioctl('/dev/kvm', ...) calls.
A user/process could use this flaw to crash the host kernel resulting in DoS or potentially escalate their privileges on a system.
Upstream patch: --------------- -> https://git.kernel.org/linus/a0f1d21c1ccb1da66629627a74059dd7f5ac9c61
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2017/01/18/10
— Red Hat
Use-after-free vulnerability in the kvmioctlcreatedevice function in virt/kvm/kvmmain.c in the Linux kernel before 4.8.13 allows host OS users to cause a denial of service (host OS crash) or possibly gain privileges via crafted ioctl calls on the /dev/kvm device.
— Launchpad
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2016-10150?
CVE-2016-10150 is a use-after-free vulnerability in the kvm_ioctl_create_device function in the Linux kernel before version 4.8.13.
How does CVE-2016-10150 affect the affected software?
CVE-2016-10150 allows host OS users to cause a denial of service (host OS crash) or possibly gain privileges via crafted ioctl calls on the /dev/kvm device.
What is the severity of CVE-2016-10150?
CVE-2016-10150 has a severity rating of high.
How can I fix CVE-2016-10150?
To fix CVE-2016-10150, you should update to Linux kernel version 4.8.13 or later.
Where can I find more information about CVE-2016-10150?
More information about CVE-2016-10150 can be found at the following references: [1](http://www.securityfocus.com/bid/95672), [2](http://www.openwall.com/lists/oss-security/2017/01/18/10), [3](http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a0f1d21c1ccb1da66629627a74059dd7f5ac9c61).