CVE-2016-9588: Medium severity Linux Linux kernel vulnerability
arch/x86/kvm/vmx.c in the Linux kernel through 4.9 mismanages the #BP and #OF exceptions, which allows guest OS users to cause a denial of service (guest OS crash) by declining to handle an exception thrown by an L2 guest.
Other sources
Linux kernel built with the KVM virtualisation support(CONFIGKVM), with nested virtualisation(nVMX) feature enabled(nested=1), is vulnerable to an uncaught exceptions issue. It could occur if a L2 guest was to throw an exception which is not handled by L1 guest.
A L1 guest user could use this flaw to crash the guest resulting in DoS.
Upstream patch -------------- -> https://www.spinics.net/lists/kvm/msg142495.html
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2016/12/15/3
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.187-1Fixed in 6.12.107-1Fixed in 7.1.13-1 - Compensating control
If nested virtualisation (nVMX) is not required, disable it so nested=1 is not used; the issue occurs when nested virtualisation is enabled.
Event History
Frequently Asked Questions
What is CVE-2016-9588?
CVE-2016-9588 is a vulnerability in the Linux kernel that mismanages the #BP and #OF exceptions, allowing guest OS users to cause a denial of service (guest OS crash).
How does CVE-2016-9588 affect Linux kernel?
CVE-2016-9588 affects the Linux kernel version through 4.9.
What is the severity level of CVE-2016-9588?
CVE-2016-9588 has a severity level of medium.
How can I fix CVE-2016-9588?
To fix CVE-2016-9588, update your Linux kernel to version 4.9 or later.
Where can I find more information about CVE-2016-9588?
You can find more information about CVE-2016-9588 at the following references: [Reference 1](https://www.spinics.net/lists/kvm/msg142495.html), [Reference 2](http://www.openwall.com/lists/oss-security/2016/12/15/3), [Reference 3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1404925).