CVE-2016-4440
published 2016-06-27CVE-2016-4440: arch/x86/kvm/vmx.c in the Linux kernel through 4.6.3 mishandles the APICv on/off state, which allows guest OS users to obtain direct APIC MSR access on the…
PriorityP335high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.36%
29.3th percentile
arch/x86/kvm/vmx.c in the Linux kernel through 4.6.3 mishandles the APICv on/off state, which allows guest OS users to obtain direct APIC MSR access on the host OS, and consequently cause a denial of service (host OS crash) or possibly execute arbitrary code on the host OS, via x2APIC mode.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 4.5.5-1 (bookworm) | linux 4.5.5-1 (bookworm) |
| linux | linux_kernel | >= 0 < 4.5.5-1 | 4.5.5-1 |
| linux | linux_kernel | >= 0 < 4.5.5-1 | 4.5.5-1 |
| linux | linux_kernel | >= 0 < 4.5.5-1 | 4.5.5-1 |
| linux | linux_kernel | >= 0 < 4.5.5-1 | 4.5.5-1 |
| linux | linux_kernel | >= 4.5 < 4.7 | 4.7 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
Kernel: kvm: vmx: incorrect state update leading to MSR access
vendor_redhat·2016-05-18·CVSS 7.8
CVE-2016-4440 [HIGH] CWE-284 Kernel: kvm: vmx: incorrect state update leading to MSR access
Kernel: kvm: vmx: incorrect state update leading to MSR access
arch/x86/kvm/vmx.c in the Linux kernel through 4.6.3 mishandles the APICv on/off state, which allows guest OS users to obtain direct APIC MSR access on the host OS, and consequently cause a denial of service (host OS crash) or possibly execute arbitrary code on the host OS, via x2APIC mode.
Statement: This issue does not affect the versions of the kernel package as shipped with
Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG 2.
Package: kernel (Red Hat Enterprise Linux 5) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: realtime-kernel (Red Hat Enterpris
Debian
CVE-2016-4440: linux - arch/x86/kvm/vmx.c in the Linux kernel through 4.6.3 mishandles the APICv on/off...
vendor_debian·2016·CVSS 7.8
CVE-2016-4440 [HIGH] CVE-2016-4440: linux - arch/x86/kvm/vmx.c in the Linux kernel through 4.6.3 mishandles the APICv on/off...
arch/x86/kvm/vmx.c in the Linux kernel through 4.6.3 mishandles the APICv on/off state, which allows guest OS users to obtain direct APIC MSR access on the host OS, and consequently cause a denial of service (host OS crash) or possibly execute arbitrary code on the host OS, via x2APIC mode.
Scope: local
bookworm: resolved (fixed in 4.5.5-1)
bullseye: resolved (fixed in 4.5.5-1)
forky: resolved (fixed in 4.5.5-1)
sid: resolved (fixed in 4.5.5-1)
trixie: resolved (fixed in 4.5.5-1)
GHSA
GHSA-862v-p357-9hfp: arch/x86/kvm/vmx
ghsa_unreviewed·2022-05-17
CVE-2016-4440 [HIGH] GHSA-862v-p357-9hfp: arch/x86/kvm/vmx
arch/x86/kvm/vmx.c in the Linux kernel through 4.6.3 mishandles the APICv on/off state, which allows guest OS users to obtain direct APIC MSR access on the host OS, and consequently cause a denial of service (host OS crash) or possibly execute arbitrary code on the host OS, via x2APIC mode.
OSV
CVE-2016-4440: arch/x86/kvm/vmx
osv·2016-06-27·CVSS 7.8
CVE-2016-4440 [HIGH] CVE-2016-4440: arch/x86/kvm/vmx
arch/x86/kvm/vmx.c in the Linux kernel through 4.6.3 mishandles the APICv on/off state, which allows guest OS users to obtain direct APIC MSR access on the host OS, and consequently cause a denial of service (host OS crash) or possibly execute arbitrary code on the host OS, via x2APIC mode.
Kernel
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm
kernel_security·2016-05-27·CVSS 7.8
CVE-2016-4440 [HIGH] Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm
Pull second batch of KVM updates from Radim Krčmář:
"General:
- move kvm_stat tool from QEMU repo into tools/kvm/kvm_stat (kvm_stat
had nothing to do with QEMU in the first place -- the tool only
interprets debugfs)
- expose per-vm statistics in debugfs and support them in kvm_stat
(KVM always collected per-vm statistics, but they were summarised
into global statistics)
x86:
- fix dynamic APICv (VMX was improperly configured and a guest could
access host's APIC MSRs, CVE-2016-4440)
- minor fixes
ARM changes from Christoffer Dall:
- new vgic reimplementation of our horribly broken legacy vgic
implementation. The two implementations will live side-by-side
(with the new being the configured default) for one kernel rele
Kernel
kvm:vmx: more complete state update on APICv on/off
kernel_security·2016-05-18·CVSS 7.8
CVE-2016-4440 [HIGH] kvm:vmx: more complete state update on APICv on/off
kvm:vmx: more complete state update on APICv on/off
The function to update APICv on/off state (in particular, to deactivate
it when enabling Hyper-V SynIC) is incomplete: it doesn't adjust
APICv-related fields among secondary processor-based VM-execution
controls. As a result, Windows 2012 guests get stuck when SynIC-based
auto-EOI interrupt intersected with e.g. an IPI in the guest.
In addition, the MSR intercept bitmap isn't updated every time "virtualize
x2APIC mode" is toggled. This path can only be triggered by a malicious
guest, because Windows didn't use x2APIC but rather their own synthetic
APIC access MSRs; however a guest running in a SynIC-enabled VM could
switch to x2APIC and thus obtain direct access to host APIC MSRs
(CVE-2016-4440).
The patch fixes those omissions.
Signe
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2016-4440 Kernel: kvm: vmx: incorrect state update leading to APIC register access [fedora-all]
bugzilla·2016-05-20·CVSS 7.8
CVE-2016-4440 [HIGH] CVE-2016-4440 Kernel: kvm: vmx: incorrect state update leading to APIC register access [fedora-all]
CVE-2016-4440 Kernel: kvm: vmx: incorrect state update leading to APIC register access [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple
Bugzilla
CVE-2016-4440 Kernel: kvm: vmx: incorrect state update leading to MSR access
bugzilla·2016-05-20·CVSS 7.8
CVE-2016-4440 [HIGH] CVE-2016-4440 Kernel: kvm: vmx: incorrect state update leading to MSR access
CVE-2016-4440 Kernel: kvm: vmx: incorrect state update leading to MSR access
Linux kernel built with the Kernel-based virtual machine(CONFIG_KVM) along
with Hyper-v Synthetic Interrupt Controller(SynIC) support is vulnerable to
an undue APIC register access issue. In that a guest with SynIC enabled, could
gain access to host's Machine Specific Registers(MSR).
A privileged user inside guest could use this flaw to crash the host kernel
resulting in DoS OR potentially leverage it to escalate privileges on the host.
Upstream patch:
-> http://permalink.gmane.org/gmane.comp.emulators.kvm.devel/152191
Reference:
-> http://comments.gmane.org/gmane.comp.emulators.kvm.devel/152100
Note: It requires fairly latest features to be available and enabled on the
host(APICv) as well as in the guest(-h
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=3ce424e45411cf5a13105e0386b6ecf6eeb4f66fhttp://www.openwall.com/lists/oss-security/2016/05/20/2https://bugzilla.redhat.com/show_bug.cgi?id=1337806https://github.com/torvalds/linux/commit/3ce424e45411cf5a13105e0386b6ecf6eeb4f66fhttp://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=3ce424e45411cf5a13105e0386b6ecf6eeb4f66fhttp://www.openwall.com/lists/oss-security/2016/05/20/2https://bugzilla.redhat.com/show_bug.cgi?id=1337806https://github.com/torvalds/linux/commit/3ce424e45411cf5a13105e0386b6ecf6eeb4f66f
2016-06-27
Published