CVE-2016-4480

Bug #1583960 reported by Steve Beattie
258
This bug affects 1 person
Affects Status Importance Assigned to Milestone
linux (Ubuntu)
Low
Unassigned
Precise
Low
Unassigned
Trusty
Low
Unassigned
Vivid
Undecided
Unassigned
Wily
Low
Unassigned
Xenial
Low
Unassigned
Yakkety
Low
Unassigned
linux-armadaxp (Ubuntu)
Low
Unassigned
Precise
Low
Unassigned
Trusty
Low
Unassigned
Vivid
Undecided
Unassigned
Wily
Low
Unassigned
Xenial
Low
Unassigned
Yakkety
Low
Unassigned
linux-flo (Ubuntu)
Low
Unassigned
Precise
Low
Unassigned
Trusty
Low
Unassigned
Vivid
Undecided
Unassigned
Wily
Low
Unassigned
Xenial
Low
Unassigned
Yakkety
Low
Unassigned
linux-goldfish (Ubuntu)
Low
Unassigned
Precise
Low
Unassigned
Trusty
Low
Unassigned
Vivid
Undecided
Unassigned
Wily
Low
Unassigned
Xenial
Low
Unassigned
Yakkety
Low
Unassigned
linux-lts-quantal (Ubuntu)
Low
Unassigned
Precise
Low
Unassigned
Trusty
Low
Unassigned
Vivid
Undecided
Unassigned
Wily
Low
Unassigned
Xenial
Low
Unassigned
Yakkety
Low
Unassigned
linux-lts-raring (Ubuntu)
Low
Unassigned
Precise
Low
Unassigned
Trusty
Low
Unassigned
Vivid
Undecided
Unassigned
Wily
Low
Unassigned
Xenial
Low
Unassigned
Yakkety
Low
Unassigned
linux-lts-saucy (Ubuntu)
Low
Unassigned
Precise
Low
Unassigned
Trusty
Low
Unassigned
Vivid
Undecided
Unassigned
Wily
Low
Unassigned
Xenial
Low
Unassigned
Yakkety
Low
Unassigned
linux-lts-trusty (Ubuntu)
Low
Unassigned
Precise
Low
Unassigned
Trusty
Low
Unassigned
Vivid
Undecided
Unassigned
Wily
Low
Unassigned
Xenial
Low
Unassigned
Yakkety
Low
Unassigned
linux-lts-utopic (Ubuntu)
Low
Unassigned
Precise
Low
Unassigned
Trusty
Low
Unassigned
Vivid
Undecided
Unassigned
Wily
Low
Unassigned
Xenial
Low
Unassigned
Yakkety
Low
Unassigned
linux-lts-vivid (Ubuntu)
Low
Unassigned
Precise
Low
Unassigned
Trusty
Low
Unassigned
Vivid
Undecided
Unassigned
Wily
Low
Unassigned
Xenial
Low
Unassigned
Yakkety
Low
Unassigned
linux-lts-wily (Ubuntu)
Low
Unassigned
Precise
Low
Unassigned
Trusty
Low
Unassigned
Vivid
Undecided
Unassigned
Wily
Low
Unassigned
Xenial
Low
Unassigned
Yakkety
Low
Unassigned
linux-lts-xenial (Ubuntu)
Low
Unassigned
Precise
Low
Unassigned
Trusty
Low
Unassigned
Vivid
Undecided
Unassigned
Wily
Low
Unassigned
Xenial
Low
Unassigned
Yakkety
Low
Unassigned
linux-mako (Ubuntu)
Low
Unassigned
Precise
Low
Unassigned
Trusty
Low
Unassigned
Vivid
Undecided
Unassigned
Wily
Low
Unassigned
Xenial
Low
Unassigned
Yakkety
Low
Unassigned
linux-manta (Ubuntu)
Low
Unassigned
Precise
Low
Unassigned
Trusty
Low
Unassigned
Vivid
Undecided
Unassigned
Wily
Low
Unassigned
Xenial
Low
Unassigned
Yakkety
Low
Unassigned
linux-raspi2 (Ubuntu)
Low
Unassigned
Precise
Low
Unassigned
Trusty
Low
Unassigned
Vivid
Undecided
Unassigned
Wily
Low
Unassigned
Xenial
Low
Unassigned
Yakkety
Low
Unassigned
linux-snapdragon (Ubuntu)
Low
Unassigned
Precise
Low
Unassigned
Trusty
Low
Unassigned
Vivid
Undecided
Unassigned
Wily
Low
Unassigned
Xenial
Low
Unassigned
Yakkety
Low
Unassigned
linux-ti-omap4 (Ubuntu)
Low
Unassigned
Precise
Low
Unassigned
Trusty
Low
Unassigned
Vivid
Undecided
Unassigned
Wily
Low
Unassigned
Xenial
Low
Unassigned
Yakkety
Low
Unassigned

Bug Description

The guest_walk_tables function in arch/x86/mm/guest_walk.c in Xen 4.6.x and earlier does not properly handle the Page Size (PS) page table entry bit at the L4 and L3 page table levels, which might allow local guest OS users to gain privileges via a crafted mapping of memory.

CVE References

Revision history for this message
Steve Beattie (sbeattie) wrote :

CVE-2016-4480

tags: added: kernel-cve-tracking-bug
information type: Public → Public Security
Changed in linux-lts-trusty (Ubuntu Wily):
status: New → Invalid
Changed in linux-lts-trusty (Ubuntu Xenial):
status: New → Invalid
Changed in linux-lts-trusty (Ubuntu Yakkety):
status: New → Invalid
Changed in linux-lts-trusty (Ubuntu Trusty):
status: New → Invalid
Changed in linux-lts-wily (Ubuntu Precise):
status: New → Invalid
Changed in linux-lts-wily (Ubuntu Wily):
status: New → Invalid
Changed in linux-lts-wily (Ubuntu Xenial):
status: New → Invalid
Changed in linux-lts-wily (Ubuntu Yakkety):
status: New → Invalid
Changed in linux-lts-quantal (Ubuntu Wily):
status: New → Invalid
Changed in linux-lts-quantal (Ubuntu Xenial):
status: New → Invalid
Changed in linux-lts-quantal (Ubuntu Yakkety):
status: New → Invalid
Changed in linux-lts-quantal (Ubuntu Trusty):
status: New → Invalid
Changed in linux-ti-omap4 (Ubuntu Wily):
status: New → Invalid
Changed in linux-ti-omap4 (Ubuntu Xenial):
status: New → Invalid
Changed in linux-ti-omap4 (Ubuntu Yakkety):
status: New → Invalid
Changed in linux-ti-omap4 (Ubuntu Trusty):
status: New → Invalid
Changed in linux-lts-raring (Ubuntu Wily):
status: New → Invalid
Changed in linux-lts-raring (Ubuntu Xenial):
status: New → Invalid
Changed in linux-lts-raring (Ubuntu Yakkety):
status: New → Invalid
Changed in linux-lts-raring (Ubuntu Trusty):
status: New → Invalid
Changed in linux-armadaxp (Ubuntu Wily):
status: New → Invalid
Changed in linux-armadaxp (Ubuntu Xenial):
status: New → Invalid
Changed in linux-armadaxp (Ubuntu Yakkety):
status: New → Invalid
Changed in linux-armadaxp (Ubuntu Trusty):
status: New → Invalid
Changed in linux-lts-xenial (Ubuntu Precise):
status: New → Invalid
Changed in linux-lts-xenial (Ubuntu Wily):
status: New → Invalid
Changed in linux-lts-xenial (Ubuntu Xenial):
status: New → Invalid
Changed in linux-lts-xenial (Ubuntu Yakkety):
status: New → Invalid
Changed in linux-lts-saucy (Ubuntu Wily):
status: New → Invalid
Changed in linux-lts-saucy (Ubuntu Xenial):
status: New → Invalid
Changed in linux-lts-saucy (Ubuntu Yakkety):
status: New → Invalid
Changed in linux-lts-saucy (Ubuntu Trusty):
status: New → Invalid
Changed in linux-manta (Ubuntu Precise):
status: New → Invalid
Changed in linux-manta (Ubuntu Xenial):
status: New → Invalid
Changed in linux-manta (Ubuntu Yakkety):
status: New → Invalid
Changed in linux-lts-vivid (Ubuntu Precise):
status: New → Invalid
Changed in linux-lts-vivid (Ubuntu Wily):
status: New → Invalid
Changed in linux-lts-vivid (Ubuntu Xenial):
status: New → Invalid
Changed in linux-lts-vivid (Ubuntu Yakkety):
status: New → Invalid
Changed in linux-raspi2 (Ubuntu Precise):
status: New → Invalid
Changed in linux-raspi2 (Ubuntu Trusty):
status: New → Invalid
Changed in linux-snapdragon (Ubuntu Precise):
status: New → Invalid
Changed in linux-snapdragon (Ubuntu Wily):
status: New → Invalid
Changed in linux-snapdragon (Ubuntu Trusty):
status: New → Invalid
Changed in linux-mako (Ubuntu Precise):
status: New → Invalid
Changed in linux-lts-utopic (Ubuntu Precise):
status: New → Invalid
Changed in linux-lts-utopic (Ubuntu Wily):
status: New → Invalid
Changed in linux-lts-utopic (Ubuntu Xenial):
status: New → Invalid
Changed in linux-lts-utopic (Ubuntu Yakkety):
status: New → Invalid
Changed in linux-goldfish (Ubuntu Precise):
status: New → Invalid
Changed in linux-flo (Ubuntu Precise):
status: New → Invalid
description: updated
Changed in linux-lts-trusty (Ubuntu Precise):
importance: Undecided → Low
Changed in linux-lts-trusty (Ubuntu Wily):
importance: Undecided → Low
Changed in linux-lts-trusty (Ubuntu Xenial):
importance: Undecided → Low
Changed in linux-lts-trusty (Ubuntu Yakkety):
importance: Undecided → Low
Changed in linux-lts-trusty (Ubuntu Trusty):
importance: Undecided → Low
Changed in linux-lts-wily (Ubuntu Precise):
importance: Undecided → Low
Changed in linux-lts-wily (Ubuntu Wily):
importance: Undecided → Low
Changed in linux-lts-wily (Ubuntu Xenial):
importance: Undecided → Low
Changed in linux-lts-wily (Ubuntu Yakkety):
importance: Undecided → Low
Changed in linux-lts-wily (Ubuntu Trusty):
importance: Undecided → Low
Changed in linux-lts-quantal (Ubuntu Precise):
status: New → Invalid
importance: Undecided → Low
Changed in linux-lts-quantal (Ubuntu Wily):
importance: Undecided → Low
Changed in linux-lts-quantal (Ubuntu Xenial):
importance: Undecided → Low
Changed in linux-lts-quantal (Ubuntu Yakkety):
importance: Undecided → Low
Changed in linux-lts-quantal (Ubuntu Trusty):
importance: Undecided → Low
Changed in linux (Ubuntu Precise):
importance: Undecided → Low
Changed in linux (Ubuntu Wily):
importance: Undecided → Low
Changed in linux (Ubuntu Xenial):
importance: Undecided → Low
Steve Beattie (sbeattie)
Changed in linux (Ubuntu Yakkety):
importance: Undecided → Low
Changed in linux (Ubuntu Trusty):
importance: Undecided → Low
Changed in linux-ti-omap4 (Ubuntu Precise):
importance: Undecided → Low
Changed in linux-ti-omap4 (Ubuntu Wily):
importance: Undecided → Low
Changed in linux-ti-omap4 (Ubuntu Xenial):
importance: Undecided → Low
Changed in linux-ti-omap4 (Ubuntu Yakkety):
importance: Undecided → Low
Changed in linux-ti-omap4 (Ubuntu Trusty):
importance: Undecided → Low
Changed in linux-lts-raring (Ubuntu Precise):
status: New → Invalid
importance: Undecided → Low
Changed in linux-lts-raring (Ubuntu Wily):
importance: Undecided → Low
Changed in linux-lts-raring (Ubuntu Xenial):
importance: Undecided → Low
Changed in linux-lts-raring (Ubuntu Yakkety):
importance: Undecided → Low
Changed in linux-lts-raring (Ubuntu Trusty):
importance: Undecided → Low
Changed in linux-armadaxp (Ubuntu Precise):
importance: Undecided → Low
Changed in linux-armadaxp (Ubuntu Wily):
importance: Undecided → Low
Changed in linux-armadaxp (Ubuntu Xenial):
importance: Undecided → Low
Changed in linux-armadaxp (Ubuntu Yakkety):
importance: Undecided → Low
Changed in linux-armadaxp (Ubuntu Trusty):
importance: Undecided → Low
Changed in linux-lts-xenial (Ubuntu Precise):
importance: Undecided → Low
Changed in linux-lts-xenial (Ubuntu Wily):
importance: Undecided → Low
Changed in linux-lts-xenial (Ubuntu Xenial):
importance: Undecided → Low
Changed in linux-lts-xenial (Ubuntu Yakkety):
importance: Undecided → Low
Changed in linux-lts-xenial (Ubuntu Trusty):
importance: Undecided → Low
Changed in linux-lts-saucy (Ubuntu Precise):
status: New → Invalid
importance: Undecided → Low
Changed in linux-lts-saucy (Ubuntu Wily):
importance: Undecided → Low
Changed in linux-lts-saucy (Ubuntu Xenial):
importance: Undecided → Low
Changed in linux-lts-saucy (Ubuntu Yakkety):
importance: Undecided → Low
Changed in linux-lts-saucy (Ubuntu Trusty):
importance: Undecided → Low
Changed in linux-manta (Ubuntu Precise):
importance: Undecided → Low
Changed in linux-manta (Ubuntu Wily):
importance: Undecided → Low
Changed in linux-manta (Ubuntu Xenial):
importance: Undecided → Low
Changed in linux-manta (Ubuntu Yakkety):
importance: Undecided → Low
Changed in linux-manta (Ubuntu Trusty):
status: New → Invalid
importance: Undecided → Low
Changed in linux-lts-vivid (Ubuntu Precise):
importance: Undecided → Low
Changed in linux-lts-vivid (Ubuntu Wily):
importance: Undecided → Low
Changed in linux-lts-vivid (Ubuntu Xenial):
importance: Undecided → Low
Changed in linux-lts-vivid (Ubuntu Yakkety):
importance: Undecided → Low
Changed in linux-lts-vivid (Ubuntu Trusty):
importance: Undecided → Low
Changed in linux-raspi2 (Ubuntu Precise):
importance: Undecided → Low
Changed in linux-raspi2 (Ubuntu Wily):
importance: Undecided → Low
Changed in linux-raspi2 (Ubuntu Xenial):
importance: Undecided → Low
Changed in linux-raspi2 (Ubuntu Yakkety):
importance: Undecided → Low
Changed in linux-raspi2 (Ubuntu Trusty):
importance: Undecided → Low
Changed in linux-snapdragon (Ubuntu Precise):
importance: Undecided → Low
Changed in linux-snapdragon (Ubuntu Wily):
importance: Undecided → Low
Changed in linux-snapdragon (Ubuntu Xenial):
importance: Undecided → Low
Changed in linux-snapdragon (Ubuntu Yakkety):
importance: Undecided → Low
Changed in linux-snapdragon (Ubuntu Trusty):
importance: Undecided → Low
Changed in linux-mako (Ubuntu Precise):
importance: Undecided → Low
Changed in linux-mako (Ubuntu Wily):
importance: Undecided → Low
Changed in linux-mako (Ubuntu Xenial):
importance: Undecided → Low
Changed in linux-mako (Ubuntu Yakkety):
importance: Undecided → Low
Changed in linux-mako (Ubuntu Trusty):
status: New → Invalid
importance: Undecided → Low
Changed in linux-lts-utopic (Ubuntu Precise):
importance: Undecided → Low
Changed in linux-lts-utopic (Ubuntu Wily):
importance: Undecided → Low
Changed in linux-lts-utopic (Ubuntu Xenial):
importance: Undecided → Low
Changed in linux-lts-utopic (Ubuntu Yakkety):
importance: Undecided → Low
Changed in linux-lts-utopic (Ubuntu Trusty):
importance: Undecided → Low
Changed in linux-goldfish (Ubuntu Precise):
importance: Undecided → Low
Changed in linux-goldfish (Ubuntu Wily):
importance: Undecided → Low
Changed in linux-goldfish (Ubuntu Xenial):
importance: Undecided → Low
Changed in linux-goldfish (Ubuntu Yakkety):
importance: Undecided → Low
Changed in linux-goldfish (Ubuntu Trusty):
status: New → Invalid
Steve Beattie (sbeattie)
Changed in linux-goldfish (Ubuntu Trusty):
importance: Undecided → Low
Changed in linux-flo (Ubuntu Precise):
importance: Undecided → Low
Changed in linux-flo (Ubuntu Wily):
importance: Undecided → Low
Changed in linux-flo (Ubuntu Xenial):
importance: Undecided → Low
Changed in linux-flo (Ubuntu Yakkety):
importance: Undecided → Low
Changed in linux-flo (Ubuntu Trusty):
status: New → Invalid
importance: Undecided → Low
Revision history for this message
Philipp Hahn (pmhahn) wrote :

Correct me if I'm wrong, but <http://xenbits.xen.org/xsa/advisory-176.html> is a *Xen* Bug, not a *Linux-Kernel* Bug: "xen/arch/x86/mm/guest_walk.c" is in the Hypervisor part of Xen.

I tried to back-port the bug to xen-4.1.6.1 from Precise but the patch is not applicable directly, as xen-4.1 does not seem to support 1GiB super pages; it was only introduced in xen-4.2:

$ git l1 -1 96b740e2
96b740e x86/mm: Handle 1GiB superpages in the pagetable walker.
$ git describe --contains 96b740e2
4.2.0-rc1~1863

I don't know what would happen if xen-4.1 would run on a CPU supporting 1GiB large pages.
Either 1GiB SP should be disabled are 96b740e2 needs to be back-ported as a pre-requisite for 46699c7393bd991234b5642763c5c24b6b39a6c4

Revision history for this message
Andy Whitcroft (apw) wrote : Closing unsupported series nomination.

This bug was nominated against a series that is no longer supported, ie yakkety. The bug task representing the yakkety nomination is being closed as Won't Fix.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

Changed in linux (Ubuntu Yakkety):
status: New → Won't Fix
Revision history for this message
Andy Whitcroft (apw) wrote :

This bug was nominated against a series that is no longer supported, ie vivid. The bug task representing the vivid nomination is being closed as Won't Fix.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

Changed in linux (Ubuntu Vivid):
status: New → Won't Fix
Andy Whitcroft (apw)
Changed in linux-armadaxp (Ubuntu Vivid):
status: New → Won't Fix
Andy Whitcroft (apw)
Changed in linux-lts-saucy (Ubuntu Vivid):
status: New → Won't Fix
Andy Whitcroft (apw)
Changed in linux-lts-trusty (Ubuntu Vivid):
status: New → Won't Fix
Andy Whitcroft (apw)
Changed in linux-lts-utopic (Ubuntu Vivid):
status: New → Won't Fix
Andy Whitcroft (apw)
Changed in linux-lts-vivid (Ubuntu Vivid):
status: New → Won't Fix
Andy Whitcroft (apw)
Changed in linux-mako (Ubuntu Vivid):
status: New → Won't Fix
Andy Whitcroft (apw)
Changed in linux-manta (Ubuntu Vivid):
status: New → Won't Fix
Andy Whitcroft (apw)
Changed in linux-raspi2 (Ubuntu Vivid):
status: New → Won't Fix
Andy Whitcroft (apw)
Changed in linux-ti-omap4 (Ubuntu Vivid):
status: New → Won't Fix
To post a comment you must log in.
This report contains Public Security information  Edit
Everyone can see this security related information.

Other bug subscribers