CVE-2016-9588

What it actually does

The flaw in arch/x86/kvm/vmx.c mismanages #BP and #OF exceptions delivered from an L2 guest, allowing the L1 guest kernel to receive unhandled exceptions that trigger a guest OS crash.

Why it matters to the business

Virtualized Linux workloads on affected kernels can experience sudden guest crashes, causing service outages and requiring manual restarts or live migration in environments that rely on KVM.

How an attack unfolds

An attacker with code execution inside an L1 guest crafts or triggers a #BP or #OF exception from an L2 guest that the L1 guest declines to handle, resulting in the L1 guest kernel crashing due to improper exception management in the KVM VMX code path.

How to fix it

Upgrade the Linux kernel to the commit ef85b67385436ddc1998f45f1d6a210f935b3388 or later; apply the vendor-supplied kernel package that contains this fix for the running distribution.

How to confirm the fix worked

Confirm the running kernel contains commit ef85b67385436ddc1998f45f1d6a210f935b3388 or a backported equivalent; test exception handling behavior with a synthetic L2 guest that issues #BP/#OF exceptions.

Typical attack path

1. Obtain code execution inside an L1 guest virtual machine
2. Create or invoke an L2 guest that deliberately generates a #BP or #OF exception
3. Configure the L1 guest to decline handling the exception
4. Trigger the exception to force the L1 guest kernel into an unhandled state and crash

How to detect it

Review kernel crash logs and hypervisor logs on KVM hosts for sudden guest terminations that coincide with exception delivery from nested guests; correlate with any custom L2 exception-generation tooling.

What your security team should do

• Prioritize kernel updates on all KVM hosts and guests that process untrusted workloads
• Verify that live-migration or restart procedures exist for affected guests before patching
• Monitor vendor kernel update channels for backports of ef85b67385436ddc1998f45f1d6a210f935b3388