CVE-2016-4480

[Steve Beattie]

The guest_walk_tables function in arch/x86/mm/guest_walk.c in Xen 4.6.x and earlier does not properly handle the Page Size (PS) page table entry bit at the L4 and L3 page table levels, which might allow local guest OS users to gain privileges via a crafted mapping of memory.

[Steve Beattie (sbeattie)]

CVE-2016-4480

[Philipp Hahn (pmhahn)]

Correct me if I'm wrong, but <http://xenbits.xen.org/xsa/advisory-176.html> is a *Xen* Bug, not a *Linux-Kernel* Bug: "xen/arch/x86/mm/guest_walk.c" is in the Hypervisor part of Xen.

I tried to back-port the bug to xen-4.1.6.1 from Precise but the patch is not applicable directly, as xen-4.1 does not seem to support 1GiB super pages; it was only introduced in xen-4.2:

$ git l1 -1 96b740e2
96b740e x86/mm: Handle 1GiB superpages in the pagetable walker.
$ git describe --contains 96b740e2
4.2.0-rc1~1863

I don't know what would happen if xen-4.1 would run on a CPU supporting 1GiB large pages.
Either 1GiB SP should be disabled are 96b740e2 needs to be back-ported as a pre-requisite for 46699c7393bd991234b5642763c5c24b6b39a6c4

[Andy Whitcroft (apw)]

This bug was nominated against a series that is no longer supported, ie yakkety. The bug task representing the yakkety nomination is being closed as Won't Fix.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

[Andy Whitcroft (apw)]

This bug was nominated against a series that is no longer supported, ie vivid. The bug task representing the vivid nomination is being closed as Won't Fix.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

[Steve Langasek (vorlon)]

The Precise Pangolin has reached end of life, so this bug will not be fixed for that release