vulnwire
8.4high

CVE-2016-4480

The guest_walk_tables function in arch/x86/mm/guest_walk.c in Xen 4.6.x and earlier does not properly handle the Page Size (PS) page table…

Published 10 y ago · modified 4 mo ago · JSON

CVSS
8.4
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.5%
percentile 46%
Public exploits
0
none known

The guest_walk_tables function in arch/x86/mm/guest_walk.c in Xen 4.6.x and earlier does not properly handle the Page Size (PS) page table entry bit at the L4 and L3 page table levels, which might allow local guest OS users to gain privileges via a crafted mapping of memory.

Exploit prediction (EPSS)

0.54% probability of exploitation in the next 30 days, higher than 46% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.08.4CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.07.2AV:L/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-264 Permissions, Privileges, and Access Controls

References

  • oracle.com /technetwork/topics/security/ovmbulletinjul2016-3090546.html · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /bid/90710 · vdb-entry, x_refsource_BID, x_transferred
  • securitytracker.com /id/1035901 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • debian.org /security/2016/dsa-3633 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • xenbits.xen.org /xsa/advisory-176.html · x_refsource_CONFIRM, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.