CVE-2016-9777

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-12-28 · updated 2026-06-17
Weakness: CWE-125

Description

KVM in the Linux kernel before 4.8.12, when I/O APIC is enabled, does not properly restrict the VCPU index, which allows guest OS users to gain host OS privileges or cause a denial of service (out-of-bounds array access and host OS crash) via a crafted interrupt request, related to arch/x86/kvm/ioapic.c and arch/x86/kvm/ioapic.h.

Affected products

Linux kernel: from 4.8 before 4.8.12 — fixed in 4.8.12

How to fix

Upgrade to a fixed version: Linux kernel 4.8.12. Check the vendor advisory for mitigations.

References

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=81cdb259fb6d8c1c4ecfeea389ff5a73c07f5755
http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.8.12
http://www.openwall.com/lists/oss-security/2016/12/02/2
http://www.securityfocus.com/bid/94640
https://bugzilla.redhat.com/show_bug.cgi?id=1400804
https://github.com/torvalds/linux/commit/81cdb259fb6d8c1c4ecfeea389ff5a73c07f5755
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=81cdb259fb6d8c1c4ecfeea389ff5a73c07f5755
http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.8.12
http://www.openwall.com/lists/oss-security/2016/12/02/2
http://www.securityfocus.com/bid/94640
https://bugzilla.redhat.com/show_bug.cgi?id=1400804
https://github.com/torvalds/linux/commit/81cdb259fb6d8c1c4ecfeea389ff5a73c07f5755

Get alerted when CVE-2016-9777 or the next vulnerability affects your stack