CVE-2016-3713
published 2016-06-27CVE-2016-3713: The msr_mtrr_valid function in arch/x86/kvm/mtrr.c in the Linux kernel before 4.6.1 supports MSR 0x2f8, which allows guest OS users to read or write to the…
PriorityP428high7.1CVSS 3.0
AVLACLPRLUINSUCHINAH
EPSS
0.34%
27.2th percentile
The msr_mtrr_valid function in arch/x86/kvm/mtrr.c in the Linux kernel before 4.6.1 supports MSR 0x2f8, which allows guest OS users to read or write to the kvm_arch_vcpu data structure, and consequently obtain sensitive information or cause a denial of service (system crash), via a crafted ioctl call.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 4.5.4-1 (bookworm) | linux 4.5.4-1 (bookworm) |
| linux | linux_kernel | <= 4.6 | — |
| linux | linux_kernel | >= 0 < 4.5.4-1 | 4.5.4-1 |
| linux | linux_kernel | >= 0 < 4.5.4-1 | 4.5.4-1 |
| linux | linux_kernel | >= 0 < 4.5.4-1 | 4.5.4-1 |
| linux | linux_kernel | >= 0 < 4.5.4-1 | 4.5.4-1 |
| linux | linux_kernel | >= 0 < 4.4.0-22.40 | 4.4.0-22.40 |
CVSS provenance
nvdv3.07.1HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
nvdv2.05.6MEDIUMAV:L/AC:L/Au:N/C:P/I:N/A:C
osv7.8HIGH
vendor_ubuntu7.8HIGH
vendor_debian7.1HIGH
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-rq49-9828-pwwr: The msr_mtrr_valid function in arch/x86/kvm/mtrr
ghsa_unreviewed·2022-05-17
CVE-2016-3713 [HIGH] CWE-284 GHSA-rq49-9828-pwwr: The msr_mtrr_valid function in arch/x86/kvm/mtrr
The msr_mtrr_valid function in arch/x86/kvm/mtrr.c in the Linux kernel before 4.6.1 supports MSR 0x2f8, which allows guest OS users to read or write to the kvm_arch_vcpu data structure, and consequently obtain sensitive information or cause a denial of service (system crash), via a crafted ioctl call.
OSV
CVE-2016-3713: The msr_mtrr_valid function in arch/x86/kvm/mtrr
osv·2016-06-27·CVSS 7.1
CVE-2016-3713 [HIGH] CVE-2016-3713: The msr_mtrr_valid function in arch/x86/kvm/mtrr
The msr_mtrr_valid function in arch/x86/kvm/mtrr.c in the Linux kernel before 4.6.1 supports MSR 0x2f8, which allows guest OS users to read or write to the kvm_arch_vcpu data structure, and consequently obtain sensitive information or cause a denial of service (system crash), via a crafted ioctl call.
Kernel
KVM: MTRR: remove MSR 0x2f8
kernel_security·2016-05-17·CVSS 7.1
CVE-2016-3713 [HIGH] KVM: MTRR: remove MSR 0x2f8
KVM: MTRR: remove MSR 0x2f8
MSR 0x2f8 accessed the 124th Variable Range MTRR ever since MTRR support
was introduced by 9ba075a664df ("KVM: MTRR support").
0x2f8 became harmful when 910a6aae4e2e ("KVM: MTRR: exactly define the
size of variable MTRRs") shrinked the array of VR MTRRs from 256 to 8,
which made access to index 124 out of bounds. The surrounding code only
WARNs in this situation, thus the guest gained a limited read/write
access to struct kvm_arch_vcpu.
0x2f8 is not a valid VR MTRR MSR, because KVM has/advertises only 16 VR
MTRR MSRs, 0x200-0x20f. Every VR MTRR is set up using two MSRs, 0x2f8
was treated as a PHYSBASE and 0x2f9 would be its PHYSMASK, but 0x2f9 was
not implemented in KVM, therefore 0x2f8 could never do anything useful
and getting rid of it is safe.
This fixes
OSV
linux vulnerabilities
osv·2016-05-16·CVSS 7.8
CVE-2016-3713 [HIGH] linux vulnerabilities
linux vulnerabilities
David Matlack discovered that the Kernel-based Virtual Machine (KVM)
implementation in the Linux kernel did not properly restrict variable
Memory Type Range Registers (MTRR) in KVM guests. A privileged user in a
guest VM could use this to cause a denial of service (system crash) in the
host, expose sensitive information from the host, or possibly gain
administrative privileges in the host. (CVE-2016-3713)
Philip Pettersson discovered that the Linux kernel's ASN.1 DER decoder did
not properly process certificate files with tags of indefinite length. A
local unprivileged attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code with administrative
privileges. (CVE-2016-0758)
OSV
linux-lts-xenial vulnerabilities
osv·2016-05-16·CVSS 7.8
[HIGH] linux-lts-xenial vulnerabilities
linux-lts-xenial vulnerabilities
USN-2979-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu
14.04 LTS.
David Matlack discovered that the Kernel-based Virtual Machine (KVM)
implementation in the Linux kernel did not properly restrict variable
Memory Type Range Registers (MTRR) in KVM guests. A privileged user in a
guest VM could use this to cause a denial of service (system crash) in the
host, expose sensitive information from the host, or possibly gain
administrative privileges in the host. (CVE-2016-3713)
Philip Pettersson discovered that the Linux kernel's ASN.1 DER decoder did
not properly process certificate files with tags of indefinite leng
OSV
linux-lts-wily vulnerabilities
osv·2016-05-16·CVSS 7.8
[HIGH] linux-lts-wily vulnerabilities
linux-lts-wily vulnerabilities
USN-2978-1 fixed vulnerabilities in the Linux kernel for Ubuntu 15.10.
This update provides the corresponding updates for the Linux Hardware
Enablement (HWE) kernel from Ubuntu 15.10 for Ubuntu 14.04 LTS.
David Matlack discovered that the Kernel-based Virtual Machine (KVM)
implementation in the Linux kernel did not properly restrict variable
Memory Type Range Registers (MTRR) in KVM guests. A privileged user in a
guest VM could use this to cause a denial of service (system crash) in the
host, expose sensitive information from the host, or possibly gain
administrative privileges in the host. (CVE-2016-3713)
Philip Pettersson discovered that the Linux kernel's ASN.1 DER decoder did
not properly process certificate files with tags of indefinite length. A
loca
Ubuntu
Linux kernel (Xenial HWE) vulnerabilities
vendor_ubuntu·2016-05-16·CVSS 7.8
CVE-2016-0758 [HIGH] Linux kernel (Xenial HWE) vulnerabilities
Title: Linux kernel (Xenial HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
USN-2979-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu
14.04 LTS.
David Matlack discovered that the Kernel-based Virtual Machine (KVM)
implementation in the Linux kernel did not properly restrict variable
Memory Type Range Registers (MTRR) in KVM guests. A privileged user in a
guest VM could use this to cause a denial of service (system crash) in the
host, expose sensitive information from the host, or possibly gain
administrative privileges in the host. (CVE-2016-3713)
Philip Pettersson discovered that the Linux kernel's ASN.1 DER dec
Ubuntu
Linux kernel (Wily HWE) vulnerabilities
vendor_ubuntu·2016-05-16·CVSS 7.8
CVE-2016-0758 [HIGH] Linux kernel (Wily HWE) vulnerabilities
Title: Linux kernel (Wily HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
USN-2978-1 fixed vulnerabilities in the Linux kernel for Ubuntu 15.10.
This update provides the corresponding updates for the Linux Hardware
Enablement (HWE) kernel from Ubuntu 15.10 for Ubuntu 14.04 LTS.
David Matlack discovered that the Kernel-based Virtual Machine (KVM)
implementation in the Linux kernel did not properly restrict variable
Memory Type Range Registers (MTRR) in KVM guests. A privileged user in a
guest VM could use this to cause a denial of service (system crash) in the
host, expose sensitive information from the host, or possibly gain
administrative privileges in the host. (CVE-2016-3713)
Philip Pettersson discovered that the Linux kernel's ASN.1 DER decoder did
n
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2016-05-16·CVSS 7.8
CVE-2016-0758 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
David Matlack discovered that the Kernel-based Virtual Machine (KVM)
implementation in the Linux kernel did not properly restrict variable
Memory Type Range Registers (MTRR) in KVM guests. A privileged user in a
guest VM could use this to cause a denial of service (system crash) in the
host, expose sensitive information from the host, or possibly gain
administrative privileges in the host. (CVE-2016-3713)
Philip Pettersson discovered that the Linux kernel's ASN.1 DER decoder did
not properly process certificate files with tags of indefinite length. A
local unprivileged attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code with administrative
pri
Red Hat
kernel: kvm: out-of-bounds access in set_var_mtrr_msr
vendor_redhat·2016-05-16·CVSS 7.1
CVE-2016-3713 [HIGH] CWE-125 kernel: kvm: out-of-bounds access in set_var_mtrr_msr
kernel: kvm: out-of-bounds access in set_var_mtrr_msr
The msr_mtrr_valid function in arch/x86/kvm/mtrr.c in the Linux kernel before 4.6.1 supports MSR 0x2f8, which allows guest OS users to read or write to the kvm_arch_vcpu data structure, and consequently obtain sensitive information or cause a denial of service (system crash), via a crafted ioctl call.
Statement: This issue does not affect the versions of the kernel package as shipped with
Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG 2.
Package: kvm (Red Hat Enterprise Linux 5) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: realtime-kernel (Red Hat Enterprise
Debian
CVE-2016-3713: linux - The msr_mtrr_valid function in arch/x86/kvm/mtrr.c in the Linux kernel before 4....
vendor_debian·2016·CVSS 7.1
CVE-2016-3713 [HIGH] CVE-2016-3713: linux - The msr_mtrr_valid function in arch/x86/kvm/mtrr.c in the Linux kernel before 4....
The msr_mtrr_valid function in arch/x86/kvm/mtrr.c in the Linux kernel before 4.6.1 supports MSR 0x2f8, which allows guest OS users to read or write to the kvm_arch_vcpu data structure, and consequently obtain sensitive information or cause a denial of service (system crash), via a crafted ioctl call.
Scope: local
bookworm: resolved (fixed in 4.5.4-1)
bullseye: resolved (fixed in 4.5.4-1)
forky: resolved (fixed in 4.5.4-1)
sid: resolved (fixed in 4.5.4-1)
trixie: resolved (fixed in 4.5.4-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2016-3713 kernel: kvm: out-of-bounds access in set_var_mtrr_msr [fedora-all]
bugzilla·2016-05-16·CVSS 7.1
CVE-2016-3713 [HIGH] CVE-2016-3713 kernel: kvm: out-of-bounds access in set_var_mtrr_msr [fedora-all]
CVE-2016-3713 kernel: kvm: out-of-bounds access in set_var_mtrr_msr [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions
Bugzilla
CVE-2016-3713 kernel: kvm: out-of-bounds access in set_var_mtrr_msr
bugzilla·2016-05-02·CVSS 7.1
CVE-2016-3713 [HIGH] CVE-2016-3713 kernel: kvm: out-of-bounds access in set_var_mtrr_msr
CVE-2016-3713 kernel: kvm: out-of-bounds access in set_var_mtrr_msr
Linux kernel built with the Kernel-based Virtual Machine(CONFIG_KVM) with variable Memory Type Range Registers(MTRR) support is vulnerable to an out-of-bounds r/w access issue. It could occur while accessing processor's MTRRs via ioctl(2) calls.
A privileged user inside guest could use this flaw to manipulate host kernel's memory bytes leading to information disclosure or crashing the kernel resulting in DoS.
Upstream patch:
-> https://lkml.org/lkml/2016/5/17/350
Reference:
-> http://www.openwall.com/lists/oss-security/2016/05/16/2
Discussion:
Acknowledgments:
Name: David Matlack (Google)
---
Created attachment 1152898
Proposed patch
---
Statement:
This issue does not affect the versions of the kernel package a
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9842df62004f366b9fed2423e24df10542ee0dc5http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.6.1http://www.openwall.com/lists/oss-security/2016/05/16/2https://bugzilla.redhat.com/show_bug.cgi?id=1332139https://github.com/torvalds/linux/commit/9842df62004f366b9fed2423e24df10542ee0dc5http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9842df62004f366b9fed2423e24df10542ee0dc5http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.6.1http://www.openwall.com/lists/oss-security/2016/05/16/2https://bugzilla.redhat.com/show_bug.cgi?id=1332139https://github.com/torvalds/linux/commit/9842df62004f366b9fed2423e24df10542ee0dc5
2016-06-27
Published