#VU33074 Input validation error - CVE-2016-3961
Vulnerability identifier: #VU33074
Vulnerability risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID:
CWE-ID:
CWE-20
Exploitation vector: Local
Exploit availability: No
Description
The vulnerability allows a local authenticated user to perform a denial of service (DoS) attack.
Xen and the Linux kernel through 4.5.x do not properly suppress hugetlbfs support in x86 PV guests, which allows local PV guest OS users to cause a denial of service (guest OS crash) by attempting to access a hugetlbfs mapped area.
Mitigation
Install update from vendor's website.
External links
https://www.debian.org/security/2016/dsa-3607
https://www.securityfocus.com/bid/86068
https://www.securitytracker.com/id/1035569
https://www.ubuntu.com/usn/USN-3001-1
https://www.ubuntu.com/usn/USN-3002-1
https://www.ubuntu.com/usn/USN-3003-1
https://www.ubuntu.com/usn/USN-3004-1
https://www.ubuntu.com/usn/USN-3005-1
https://www.ubuntu.com/usn/USN-3006-1
https://www.ubuntu.com/usn/USN-3007-1
https://www.ubuntu.com/usn/USN-3049-1
https://www.ubuntu.com/usn/USN-3050-1
https://xenbits.xen.org/xsa/advisory-174.html
https://xenbits.xen.org/xsa/xsa174.patch
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
