CVE-2016-2143
published 2016-04-27CVE-2016-2143: The fork implementation in the Linux kernel before 4.5 on s390 platforms mishandles the case of four page-table levels, which allows local users to cause a…
PriorityP431high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
0.56%
42.7th percentile
The fork implementation in the Linux kernel before 4.5 on s390 platforms mishandles the case of four page-table levels, which allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted application, related to arch/s390/include/asm/mmu_context.h and arch/s390/include/asm/pgalloc.h.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | linux | < linux 4.4.6-1 (bookworm) | linux 4.4.6-1 (bookworm) |
| linux | linux_kernel | >= 0 < 4.4.6-1 | 4.4.6-1 |
| linux | linux_kernel | >= 0 < 4.4.6-1 | 4.4.6-1 |
| linux | linux_kernel | >= 0 < 4.4.6-1 | 4.4.6-1 |
| linux | linux_kernel | >= 0 < 4.4.6-1 | 4.4.6-1 |
| linux | linux_kernel | >= 2.6.25 < 3.2.79 | 3.2.79 |
| linux | linux_kernel | >= 3.13 < 3.16.35 | 3.16.35 |
| linux | linux_kernel | >= 3.17 < 4.1.21 | 4.1.21 |
| linux | linux_kernel | >= 3.3 < 3.12.58 | 3.12.58 |
| linux | linux_kernel | >= 4.2 < 4.4.6 | 4.4.6 |
| oracle | linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.9MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-h8j9-2jj6-73jj: The fork implementation in the Linux kernel before 4
ghsa_unreviewed·2022-05-14
CVE-2016-2143 [HIGH] CWE-20 GHSA-h8j9-2jj6-73jj: The fork implementation in the Linux kernel before 4
The fork implementation in the Linux kernel before 4.5 on s390 platforms mishandles the case of four page-table levels, which allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted application, related to arch/s390/include/asm/mmu_context.h and arch/s390/include/asm/pgalloc.h.
OSV
CVE-2016-2143: The fork implementation in the Linux kernel before 4
osv·2016-04-27·CVSS 7.8
CVE-2016-2143 [HIGH] CVE-2016-2143: The fork implementation in the Linux kernel before 4
The fork implementation in the Linux kernel before 4.5 on s390 platforms mishandles the case of four page-table levels, which allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted application, related to arch/s390/include/asm/mmu_context.h and arch/s390/include/asm/pgalloc.h.
Kernel
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux
kernel_security·2016-03-10·CVSS 7.8
CVE-2016-2143 [HIGH] Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux
Pull s390 fixes from Martin Schwidefsky:
"Three bug fixes:
- The fix for the page table corruption (CVE-2016-2143)
- The diagnose statistics introduced a regression for the dasd diag
driver
- Boot crash on systems without the set-program-parameters facility"
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
s390/mm: four page table levels vs. fork
s390/cpumf: Fix lpp detection
s390/dasd: fix diag 0x250 inline assembly
Kernel
s390/mm: four page table levels vs. fork
kernel_security·2016-02-15·CVSS 7.8
CVE-2016-2143 [HIGH] s390/mm: four page table levels vs. fork
s390/mm: four page table levels vs. fork
The fork of a process with four page table levels is broken since
git commit 6252d702c5311ce9 "[S390] dynamic page tables."
All new mm contexts are created with three page table levels and
an asce limit of 4TB. If the parent has four levels dup_mmap will
add vmas to the new context which are outside of the asce limit.
The subsequent call to copy_page_range will walk the three level
page table structure of the new process with non-zero pgd and pud
indexes. This leads to memory clobbers as the pgd_index *and* the
pud_index is added to the mm->pgd pointer without a pgd_deref
in between.
The init_new_context() function is selecting the number of page
table levels for a new context. The function is used by mm_init()
which in turn is called by dup_mm()
Red Hat
kernel: Fork of large process causes memory corruption
vendor_redhat·2016-06-01·CVSS 7.8
CVE-2016-2143 [HIGH] CWE-119 kernel: Fork of large process causes memory corruption
kernel: Fork of large process causes memory corruption
The fork implementation in the Linux kernel before 4.5 on s390 platforms mishandles the case of four page-table levels, which allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted application, related to arch/s390/include/asm/mmu_context.h and arch/s390/include/asm/pgalloc.h.
It was reported that on s390x, the fork of a process with four page table levels will cause memory corruption with a variety of symptoms. All processes are created with three level page table and a limit of 4TB for the address space. If the parent process has four page table levels with a limit of 8PB, the function that duplicates the address space will try to copy memory areas outside of the addre
Debian
CVE-2016-2143: linux - The fork implementation in the Linux kernel before 4.5 on s390 platforms mishand...
vendor_debian·2016·CVSS 7.8
CVE-2016-2143 [HIGH] CVE-2016-2143: linux - The fork implementation in the Linux kernel before 4.5 on s390 platforms mishand...
The fork implementation in the Linux kernel before 4.5 on s390 platforms mishandles the case of four page-table levels, which allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted application, related to arch/s390/include/asm/mmu_context.h and arch/s390/include/asm/pgalloc.h.
Scope: local
bookworm: resolved (fixed in 4.4.6-1)
bullseye: resolved (fixed in 4.4.6-1)
forky: resolved (fixed in 4.4.6-1)
sid: resolved (fixed in 4.4.6-1)
trixie: resolved (fixed in 4.4.6-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2016-2143 kernel: Fork of large process causes memory corruption [fedora-all]
bugzilla·2016-06-01·CVSS 7.8
CVE-2016-2143 [HIGH] CVE-2016-2143 kernel: Fork of large process causes memory corruption [fedora-all]
CVE-2016-2143 kernel: Fork of large process causes memory corruption [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions
Bugzilla
CVE-2016-2143 kernel: Fork of large process causes memory corruption
bugzilla·2016-02-16·CVSS 7.8
CVE-2016-2143 [HIGH] CVE-2016-2143 kernel: Fork of large process causes memory corruption
CVE-2016-2143 kernel: Fork of large process causes memory corruption
It was reported that on s390x, the fork of a process with four page table levels will cause memory corruption with a variety of symptoms. All processes are created with three level page table and a limit of 4TB for the address space. If the parent process has four page table levels with a limit of 8PB, the function that duplicates the address space will try to copy memory areas outside of the address space limit for the child process.
Upstream patch:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=3446c13b268af86391d06611327006b059b8bab1
Discussion:
Created kernel tracking bugs for this issue:
Affects: fedora-all [bug 1341544]
---
This issue has been addressed in the following products:
arXiv
SBOMproof: Beyond Alleged SBOM Compliance for Supply Chain Security of Container Images
arxiv_fulltext·2025-10-07
SBOMproof: Beyond Alleged SBOM Compliance for Supply Chain Security of Container Images
SBOMproof: Beyond Alleged SBOM Compliance for Supply Chain Security of Container Images
Jacopo Bufalino
Cnam, Cedric, Paris, France
Aalto University, Espoo, Finland
[email protected]
Mario Di Francesco
Aalto University, Espoo, Finland
[email protected]
Agathe Blaise
Thales SIX GTS France,
Gennevilliers, France
[email protected]
Stefano Secci
Cnam, Cedric, Paris, France
[email protected]
observationcounter
observationcounter1
8.7510
observation
colback=gray!10,
colframe=gray!70,
boxrule=0.5mm,
arc=1mm,
left=2mm,
right=2mm,
top=1mm,
bottom=1mm,
before upper=observationcounter,
title=Observation ,
fontupper= ,
fonttitle= ,
code=1.025
## Abstract
Supply chain security is extremely important for modern applications running at scale in the cloud.
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=3446c13b268af86391d06611327006b059b8bab1http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00019.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-06/msg00052.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-06/msg00054.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-06/msg00059.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-07/msg00005.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-08/msg00038.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1539.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2766.htmlhttp://www.debian.org/security/2016/dsa-3607http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.htmlhttps://github.com/torvalds/linux/commit/3446c13b268af86391d06611327006b059b8bab1https://security-tracker.debian.org/tracker/CVE-2016-2143http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=3446c13b268af86391d06611327006b059b8bab1http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00019.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-06/msg00052.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-06/msg00054.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-06/msg00059.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-07/msg00005.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-08/msg00038.htmlhttp://rhn.redhat.com/errata/RHSA-2016-1539.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2766.htmlhttp://www.debian.org/security/2016/dsa-3607http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.htmlhttps://github.com/torvalds/linux/commit/3446c13b268af86391d06611327006b059b8bab1https://security-tracker.debian.org/tracker/CVE-2016-2143
2016-04-27
Published