CVE-2016-7092
published 2016-09-21CVE-2016-7092: The get_page_from_l3e function in arch/x86/mm.c in Xen allows local 32-bit PV guest OS administrators to gain host OS privileges via vectors related to L3…
PriorityP434high8.2CVSS 3.0
AVLACLPRHUINSCCHIHAH
EPSS
0.40%
32.5th percentile
The get_page_from_l3e function in arch/x86/mm.c in Xen allows local 32-bit PV guest OS administrators to gain host OS privileges via vectors related to L3 recursive pagetables.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | xen | < xen 4.8.0~rc3-1 (bookworm) | xen 4.8.0~rc3-1 (bookworm) |
| xen | xen | >= 0 < 4.8.0~rc3-1 | 4.8.0~rc3-1 |
| xen | xen | >= 0 < 4.8.0~rc3-1 | 4.8.0~rc3-1 |
| xen | xen | >= 0 < 4.8.0~rc3-1 | 4.8.0~rc3-1 |
| xen | xen | >= 0 < 4.8.0~rc3-1 | 4.8.0~rc3-1 |
CVSS provenance
nvdv3.08.2HIGHCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:L/AC:L/Au:S/C:C/I:C/A:C
osv8.2HIGH
vendor_debian8.2HIGH
vendor_redhat8.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
xen: x86: Disallow L3 recursive pagetable for 32-bit PV guests
vendor_redhat·2016-09-08·CVSS 8.2
CVE-2016-7092 [HIGH] xen: x86: Disallow L3 recursive pagetable for 32-bit PV guests
xen: x86: Disallow L3 recursive pagetable for 32-bit PV guests
The get_page_from_l3e function in arch/x86/mm.c in Xen allows local 32-bit PV guest OS administrators to gain host OS privileges via vectors related to L3 recursive pagetables.
Package: xen (Red Hat Enterprise Linux 5) - Will not fix
Debian
CVE-2016-7092: xen - The get_page_from_l3e function in arch/x86/mm.c in Xen allows local 32-bit PV gu...
vendor_debian·2016·CVSS 8.2
CVE-2016-7092 [HIGH] CVE-2016-7092: xen - The get_page_from_l3e function in arch/x86/mm.c in Xen allows local 32-bit PV gu...
The get_page_from_l3e function in arch/x86/mm.c in Xen allows local 32-bit PV guest OS administrators to gain host OS privileges via vectors related to L3 recursive pagetables.
Scope: local
bookworm: resolved (fixed in 4.8.0~rc3-1)
bullseye: resolved (fixed in 4.8.0~rc3-1)
forky: resolved (fixed in 4.8.0~rc3-1)
sid: resolved (fixed in 4.8.0~rc3-1)
trixie: resolved (fixed in 4.8.0~rc3-1)
GHSA
GHSA-9wwx-4vrv-gxfw: The get_page_from_l3e function in arch/x86/mm
ghsa_unreviewed·2022-05-17
CVE-2016-7092 [HIGH] GHSA-9wwx-4vrv-gxfw: The get_page_from_l3e function in arch/x86/mm
The get_page_from_l3e function in arch/x86/mm.c in Xen allows local 32-bit PV guest OS administrators to gain host OS privileges via vectors related to L3 recursive pagetables.
OSV
CVE-2016-7092: The get_page_from_l3e function in arch/x86/mm
osv·2016-09-21·CVSS 8.2
CVE-2016-7092 [HIGH] CVE-2016-7092: The get_page_from_l3e function in arch/x86/mm
The get_page_from_l3e function in arch/x86/mm.c in Xen allows local 32-bit PV guest OS administrators to gain host OS privileges via vectors related to L3 recursive pagetables.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2016-7092 xen: x86: Disallow L3 recursive pagetable for 32-bit PV guests [fedora-all]
bugzilla·2016-09-08·CVSS 8.2
CVE-2016-7092 [HIGH] CVE-2016-7092 xen: x86: Disallow L3 recursive pagetable for 32-bit PV guests [fedora-all]
CVE-2016-7092 xen: x86: Disallow L3 recursive pagetable for 32-bit PV guests [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported
Bugzilla
CVE-2016-7092 xen: x86: Disallow L3 recursive pagetable for 32-bit PV guests
bugzilla·2016-08-26·CVSS 8.2
CVE-2016-7092 [HIGH] CVE-2016-7092 xen: x86: Disallow L3 recursive pagetable for 32-bit PV guests
CVE-2016-7092 xen: x86: Disallow L3 recursive pagetable for 32-bit PV guests
ISSUE DESCRIPTION
On real hardware, a 32-bit PAE guest must leave the USER and RW bit
clear in L3 pagetable entries, but the pagetable walk behaves as if
they were set. (The L3 entries are cached in processor registers, and
don't actually form part of the pagewalk.)
When running a 32-bit PV guest on a 64-bit Xen, Xen must always OR in
the USER and RW bits for L3 updates for the guest to observe
architectural behaviour. This is unsafe in combination with recursive
pagetables.
As there is no way to construct an L3 recursive pagetable in native
32-bit PAE mode, disallow this option in 32-bit PV guests.
IMPACT
A malicious 32-bit PV guest administrator can escalate their privilege
to that of the host.
VULNERABLE
http://support.citrix.com/article/CTX216071http://www.debian.org/security/2016/dsa-3663http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.htmlhttp://www.securityfocus.com/bid/92862http://www.securitytracker.com/id/1036751http://xenbits.xen.org/xsa/advisory-185.htmlhttp://xenbits.xen.org/xsa/xsa185.patchhttps://security.gentoo.org/glsa/201611-09http://support.citrix.com/article/CTX216071http://www.debian.org/security/2016/dsa-3663http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.htmlhttp://www.securityfocus.com/bid/92862http://www.securitytracker.com/id/1036751http://xenbits.xen.org/xsa/advisory-185.htmlhttp://xenbits.xen.org/xsa/xsa185.patchhttps://security.gentoo.org/glsa/201611-09
2016-09-21
Published