#VU33074 Input validation error - CVE-2016-3961


| Updated: 2020-08-03

Vulnerability identifier: #VU33074

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-3961

CWE-ID: CWE-20

Exploitation vector: Local

Exploit availability: No

Description

The vulnerability allows a local authenticated user to perform a denial of service (DoS) attack.

Xen and the Linux kernel through 4.5.x do not properly suppress hugetlbfs support in x86 PV guests, which allows local PV guest OS users to cause a denial of service (guest OS crash) by attempting to access a hugetlbfs mapped area.

Mitigation
Install update from vendor's website.

External links
https://www.debian.org/security/2016/dsa-3607
https://www.securityfocus.com/bid/86068
https://www.securitytracker.com/id/1035569
https://www.ubuntu.com/usn/USN-3001-1
https://www.ubuntu.com/usn/USN-3002-1
https://www.ubuntu.com/usn/USN-3003-1
https://www.ubuntu.com/usn/USN-3004-1
https://www.ubuntu.com/usn/USN-3005-1
https://www.ubuntu.com/usn/USN-3006-1
https://www.ubuntu.com/usn/USN-3007-1
https://www.ubuntu.com/usn/USN-3049-1
https://www.ubuntu.com/usn/USN-3050-1
https://xenbits.xen.org/xsa/advisory-174.html
https://xenbits.xen.org/xsa/xsa174.patch


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.


Latest bulletins with this vulnerability