Summaryinfo

A vulnerability was found in Linux Kernel up to 4.6.3. It has been classified as critical. Affected is the function mt_rand of the file arch/x86/kvm/vmx.c of the component APICv State Handler. The manipulation of the argument https:/bugzilla.redhat.com/show_bug.cgi?id=1337806 leads to access control. This vulnerability is listed as CVE-2016-4440. The attack must be carried out locally. There is no available exploit. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Linux Kernel up to 4.6.3 (Operating System). This issue affects the function mt_rand of the file arch/x86/kvm/vmx.c of the component APICv State Handler. The manipulation of the argument https:/bugzilla.redhat.com/show_bug.cgi?id=1337806 with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-264. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

arch/x86/kvm/vmx.c in the Linux kernel through 4.6.3 mishandles the APICv on/off state, which allows guest OS users to obtain direct APIC MSR access on the host OS, and consequently cause a denial of service (host OS crash) or possibly execute arbitrary code on the host OS, via x2APIC mode.

The weakness was presented 05/20/2016 (oss-sec). The advisory is shared at openwall.com. The identification of this vulnerability is CVE-2016-4440 since 05/02/2016. The exploitation is known to be easy. An attack has to be approached locally. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1068 for this issue. The following code is the reason for this vulnerability:

if (enable_apicv)

The vulnerability scanner Nessus provides a plugin with the ID 92055 (Fedora 23 : kernel (2016-06f1572324)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Fedora Local Security Checks and running in the context l.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. A possible mitigation has been published 2 weeks after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (92055). See VDB-88377, VDB-88376, VDB-88375 and VDB-88374 for similar entries. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 4.6.0
• 4.6.1
• 4.6.2
• 4.6.3

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion