CVE-2016-9777 — Kernel: kvm: out of bounds memory access via vcpu_id

Back Back to CVE browser

HIGH

Kernel: kvm: out of bounds memory access via vcpu_id

Published Dec 28, 2016

7.8

HIGH

CVSS 3.1

EPSS 0.38%

Description

KVM in the Linux kernel before 4.8.12, when I/O APIC is enabled, does not properly restrict the VCPU index, which allows guest OS users to gain host OS privileges or cause a denial of service (out-of-bounds array access and host OS crash) via a crafted interrupt request, related to arch/x86/kvm/ioapic.c and arch/x86/kvm/ioapic.h.

Affected products

Red Hat Enterprise Linux 5

kernel

Not affected
Red Hat Enterprise Linux 6

kernel

Not affected
Red Hat Enterprise Linux 7

kernel

Not affected
Red Hat Enterprise Linux 7

kernel-rt

Not affected
Red Hat Enterprise MRG 2

realtime-kernel

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 5	kernel	Not affected	n/a
Red Hat Enterprise Linux 6	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel-rt	Not affected	n/a
Red Hat Enterprise MRG 2	realtime-kernel	Not affected	n/a

Remediation

Red Hat statement

This issue does not affect the versions of the kernel package as shipped with Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG 2.

Metrics

0.38% 0.00380

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00380

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (10 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.38% (0.00380)	29.59th	v5 (v2026.06.15)
Jun 15, 2026	0.38% (0.00380)	29.61th	v5 (v2026.06.15)
Mar 17, 2025	0.07% (0.00072)	19.31th	v4 (v2025.03.14)
Dec 12, 2024	0.06% (0.00062)	28.60th	v3 (v2023.03.01)
Jun 13, 2024	0.06% (0.00062)	26.61th	v3 (v2023.03.01)
Mar 7, 2023	0.06% (0.00062)	24.59th	v3 (v2023.03.01)
Mar 6, 2023	1.03% (0.01034)	41.69th	v2 (v2022.01.01)
Sep 10, 2022	1.03% (0.01034)	39.91th	v2 (v2022.01.01)
Apr 1, 2022	1.03% (0.01034)	37.91th	v2 (v2022.01.01)
Feb 4, 2022	1.03% (0.01034)	20.32th	v2 (v2022.01.01)

Weaknesses (2)

CWE-125

Out-of-bounds Read

CWE-787

Out-of-bounds Write

References (9)

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=81cdb259fb6d8c1c4ecfeea389ff5a73c07f5755
x_refsource_CONFIRMPatchVendor Advisory
http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.8.12
x_refsource_CONFIRMRelease Notes
http://www.openwall.com/lists/oss-security/2016/12/02/2
mailing-listx_refsource_MLISTMailing ListPatch
http://www.securityfocus.com/bid/94640
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://access.redhat.com/security/cve/CVE-2016-9777
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1400804
x_refsource_CONFIRMIssue Tracking
https://github.com/torvalds/linux/commit/81cdb259fb6d8c1c4ecfeea389ff5a73c07f5755
x_refsource_CONFIRMPatchVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2016-9777
https://www.cve.org/CVERecord?id=CVE-2016-9777

Link	Providers	Tags
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=81cdb259fb6d8c1c4ecfeea389ff5a73c07f5755		x_refsource_CONFIRMPatchVendor Advisory
http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.8.12		x_refsource_CONFIRMRelease Notes
http://www.openwall.com/lists/oss-security/2016/12/02/2		mailing-listx_refsource_MLISTMailing ListPatch
http://www.securityfocus.com/bid/94640		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://access.redhat.com/security/cve/CVE-2016-9777		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1400804		x_refsource_CONFIRMIssue Tracking
https://github.com/torvalds/linux/commit/81cdb259fb6d8c1c4ecfeea389ff5a73c07f5755		x_refsource_CONFIRMPatchVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2016-9777
https://www.cve.org/CVERecord?id=CVE-2016-9777