CVE-2016-9756

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

arch/x86/kvm/emulate.c in the Linux kernel before 4.8.12 does not properly initialize Code Segment (CS) in certain error cases, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2117d5398c81554fbf803f5fd1dc55eb78216c0cPatch, Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00000.html
http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.8.12Release Notes
http://www.openwall.com/lists/oss-security/2016/12/01/1Mailing List, Patch
http://www.securityfocus.com/bid/94615
https://bugzilla.redhat.com/show_bug.cgi?id=1400468Issue Tracking
https://github.com/torvalds/linux/commit/2117d5398c81554fbf803f5fd1dc55eb78216c0cPatch, Vendor Advisory
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2117d5398c81554fbf803f5fd1dc55eb78216c0cPatch, Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2017-01/msg00000.html
http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.8.12Release Notes
http://www.openwall.com/lists/oss-security/2016/12/01/1Mailing List, Patch
http://www.securityfocus.com/bid/94615
https://bugzilla.redhat.com/show_bug.cgi?id=1400468Issue Tracking
https://github.com/torvalds/linux/commit/2117d5398c81554fbf803f5fd1dc55eb78216c0cPatch, Vendor Advisory

Timeline

Published: Dec 28, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-97575.4In the Create Tags page of the Rapid7 Nexpose version 6.4.12 user interface, any authenticated user who has the capability to create tags ca CVE-2016-97725.3OpenAFS 1.6.19 and earlier allows remote attackers to obtain sensitive directory information via vectors involving the (1) client cache part CVE-2016-97735.5Heap-based buffer overflow in the IsPixelGray function in MagickCore/pixel-accessor.h in ImageMagick 7.0.3.8 allows remote attackers to caus CVE-2016-97747.8The postinst script in the tomcat6 package before 6.0.45+dfsg-1~deb7u4 on Debian wheezy, before 6.0.35-1ubuntu3.9 on Ubuntu 12.04 LTS and on CVE-2016-97757.8The postrm script in the tomcat6 package before 6.0.45+dfsg-1~deb7u3 on Debian wheezy, before 6.0.45+dfsg-1~deb8u1 on Debian jessie, before CVE-2016-97765.5QEMU (aka Quick Emulator) built with the ColdFire Fast Ethernet Controller emulator support is vulnerable to an infinite loop issue. It coul CVE-2016-97777.8KVM in the Linux kernel before 4.8.12, when I/O APIC is enabled, does not properly restrict the VCPU index, which allows guest OS users to g CVE-2016-97785.9An error in handling certain queries can cause an assertion failure when a server is using the nxdomain-redirect feature to cover a zone for CVE-2016-97937.8The sock_setsockopt function in net/core/sock.c in the Linux kernel before 4.8.14 mishandles negative values of sk_sndbuf and sk_rcvbuf, whi CVE-2016-97947.8Race condition in the snd_pcm_period_elapsed function in sound/core/pcm_lib.c in the ALSA subsystem in the Linux kernel before 4.7 allows lo CVE-2016-97957.8The casrvc program in CA Common Services, as used in CA Client Automation 12.8, 12.9, and 14.0; CA SystemEDGE 5.8.2 and 5.9; CA Systems Perf CVE-2016-97969.8Alcatel-Lucent OmniVista 8770 2.0 through 3.0 exposes different ORBs interfaces, which can be queried using the GIOP protocol on TCP port 30