CVE-2016-9083: Buffer Overflow
A flaw was discovered in the Linux kernels implementation of VFIO. While issuing an IOCTL, the VFIODEVICESETIRQS parameter for vfio PCI devices has a state machine confusion bug where specifying VFIOIRQSETDATANONE along with another bit in VFIOIRQSETDATATYPEMASK in hdr.flags allows integer overflow checks to be skipped for hdr.start/hdr.count.
This might allow memory corruption later in vfiopcisetmsitrigger() with user access to an appropriate vfio device file, but it seems difficult to usefully exploit in practice.
Proposed patch:
https://patchwork.kernel.org/patch/9373631/
CVE assignment:
http://seclists.org/oss-sec/2016/q4/251
Other sources
drivers/vfio/pci/vfiopci.c in the Linux kernel through 4.8.11 allows local users to bypass integer overflow checks, and cause a denial of service (memory corruption) or have unspecified other impact, by leveraging access to a vfio PCI device file for a VFIODEVICESETIRQS ioctl call, aka a "state machine confusion bug."
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2016-9083?
CVE-2016-9083 is a vulnerability in the Linux kernel that allows local users to bypass integer overflow checks and cause memory corruption or other unspecified impact.
How severe is CVE-2016-9083?
CVE-2016-9083 has a severity level of high with a severity value of 7.
What software versions are affected by CVE-2016-9083?
CVE-2016-9083 affects Linux kernel versions up to 4.8.11.
Is there a fix for CVE-2016-9083?
Yes, upgrading to Linux kernel version 4.9 or later will fix the vulnerability.
Where can I find more information about CVE-2016-9083?
More information about CVE-2016-9083 can be found in the references section of the vulnerability report.