CVE-2016-9777: High severity linux kernel vulnerability
KVM in the Linux kernel before 4.8.12, when I/O APIC is enabled, does not properly restrict the VCPU index, which allows guest OS users to gain host OS privileges or cause a denial of service (out-of-bounds array access and host OS crash) via a crafted interrupt request, related to arch/x86/kvm/ioapic.c and arch/x86/kvm/ioapic.h.
Other sources
Linux kernel built with the Kernel-based Virtual Machine(CONFIGKVM) support is vulnerable to an out-of-bounds memory access issue. It could occur on x86 platform, while servicing I/O APIC requests with larger vcpuid.
A guest user/process could use this flaw to crash the host kernel resulting in DoS or it could potentially be used to escalate privileges on a host.
Upstream patch: --------------- -> https://git.kernel.org/linus/81cdb259fb6d8c1c4ecfeea389ff5a73c07f5755
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2016/12/02/2
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9777?
The severity of CVE-2016-9777 is high, with a severity value of 7.
How does CVE-2016-9777 impact Linux?
CVE-2016-9777 allows guest OS users to gain host OS privileges or cause a denial of service in Linux when I/O APIC is enabled.
Which versions of Linux are affected by CVE-2016-9777?
Linux versions before 4.8.12 are affected by CVE-2016-9777.
How can I fix CVE-2016-9777 on Ubuntu?
To fix CVE-2016-9777 on Ubuntu, update the linux package to version 4.8.0-37.39 or higher, or version 4.9~ or higher.
Where can I find more information about CVE-2016-9777?
You can find more information about CVE-2016-9777 at the following references: [link1], [link2], [link3].