Input validation error - CVE-2016-3961
Published: April 15, 2016 / Updated: August 3, 2020
Vulnerability identifier: #VU33074
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-3961
CWE-ID: CWE-20
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local authenticated user to perform a denial of service (DoS) attack.
Xen and the Linux kernel through 4.5.x do not properly suppress hugetlbfs support in x86 PV guests, which allows local PV guest OS users to cause a denial of service (guest OS crash) by attempting to access a hugetlbfs mapped area.
Affected software
linux-grsec (Alpine package)
linux-vanilla (Alpine package)
binutils
kernel
Fedora
linux-vanilla (Alpine package)
binutils
kernel
Fedora
How to mitigate CVE-2016-3961
Install update from vendor's website.
binutils - update to 2.26-18.fc24
kernel - addressed in versions 4.4.8-200.fc22, 4.4.8-300.fc23, 4.5.2-301.fc24
kernel - addressed in versions 4.4.8-200.fc22, 4.4.8-300.fc23, 4.5.2-301.fc24
External References
- http://www.debian.org/security/2016/dsa-3607
- http://www.securityfocus.com/bid/86068
- http://www.securitytracker.com/id/1035569
- http://www.ubuntu.com/usn/USN-3001-1
- http://www.ubuntu.com/usn/USN-3002-1
- http://www.ubuntu.com/usn/USN-3003-1
- http://www.ubuntu.com/usn/USN-3004-1
- http://www.ubuntu.com/usn/USN-3005-1
- http://www.ubuntu.com/usn/USN-3006-1
- http://www.ubuntu.com/usn/USN-3007-1
- http://www.ubuntu.com/usn/USN-3049-1
- http://www.ubuntu.com/usn/USN-3050-1
- http://xenbits.xen.org/xsa/advisory-174.html
- http://xenbits.xen.org/xsa/xsa174.patch