Bug 979715 – VUL-0: CVE-2016-3713: kernel: kvm: OOB r/w access issue with MSR 0x2F8

Bug 979715 - (CVE-2016-3713) VUL-0: CVE-2016-3713: kernel: kvm: OOB r/w access issue with MSR 0x2F8

(CVE-2016-3713)
Summary:	VUL-0: CVE-2016-3713: kernel: kvm: OOB r/w access issue with MSR 0x2F8

Status:	RESOLVED FIXED

Classification:	Novell Products
Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents
Version:	unspecified
Hardware:	Other Other

Priority:	P3 - Medium Severity: Normal
Target Milestone:	---
Assigned To:	Security Team bot
QA Contact:	Security Team bot

URL:
Whiteboard:	CVSSv2:SUSE:CVE-2016-3713:4.9:(AV:A/A...
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2016-05-12 13:53 UTC by Alexander Bergmann
Modified:	2020-07-27 10:13 UTC (History)
CC List:	6 users (show)

See Also:
Found By:	---
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Comment 1 Swamp Workflow Management 2016-05-12 22:00:59 UTC

bugbot adjusting priority

Comment 4 Michal Marek 2016-05-16 13:39:47 UTC

Please confirm that the issue is public now and the fix can be pulled into the publicly visible kernel git branches.

Comment 6 Alexander Bergmann 2016-05-17 06:42:32 UTC

Issue is public now.

http://www.openwall.com/lists/oss-security/2016/05/16/2
https://bugzilla.redhat.com/show_bug.cgi?id=1332139

Linux kernel built with the Kernel-based Virtual Machine(CONFIG_KVM) with 
variable Memory Type Range Registers(MTRR) support is vulnerable to an 
out-of-bounds r/w access issue. It could occur while accessing processor's 
MTRRs via ioctl(2) calls.

A privileged user inside guest could use this flaw to manipulate host kernel's 
memory bytes leading to information disclosure OR potentially crashing the 
kernel resulting in DoS.

'CVE-2016-3713' has been assigned to this issue by Red Hat Inc. A proposed 
patch is attached herein to fix this issue.

Comment 8 Marcus Meissner 2017-03-01 14:17:51 UTC

fixed in SLES 12 SP2 GA