Input validation error - CVE-2016-3961
Published: April 15, 2016 / Updated: August 3, 2020
Vulnerability identifier: #VU33074
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2016-3961
CWE-ID: CWE-20
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vendor:
Affected software:
Detailed vulnerability description
The vulnerability allows a local authenticated user to perform a denial of service (DoS) attack.
Xen and the Linux kernel through 4.5.x do not properly suppress hugetlbfs support in x86 PV guests, which allows local PV guest OS users to cause a denial of service (guest OS crash) by attempting to access a hugetlbfs mapped area.
How to mitigate CVE-2016-3961
Install update from vendor's website.
Sources
- http://www.debian.org/security/2016/dsa-3607
- http://www.securityfocus.com/bid/86068
- http://www.securitytracker.com/id/1035569
- http://www.ubuntu.com/usn/USN-3001-1
- http://www.ubuntu.com/usn/USN-3002-1
- http://www.ubuntu.com/usn/USN-3003-1
- http://www.ubuntu.com/usn/USN-3004-1
- http://www.ubuntu.com/usn/USN-3005-1
- http://www.ubuntu.com/usn/USN-3006-1
- http://www.ubuntu.com/usn/USN-3007-1
- http://www.ubuntu.com/usn/USN-3049-1
- http://www.ubuntu.com/usn/USN-3050-1
- http://xenbits.xen.org/xsa/advisory-174.html
- http://xenbits.xen.org/xsa/xsa174.patch