The guest_walk_tables function in arch/x86/mm/guest_walk.c in Xen 4.6.x and earlier does not properly handle the Page Size (PS) page table entry bit at the L4 and L3 page table levels, which might allow local guest OS users to gain privileges via a crafted mapping of memory.
CVSS Details
- CVSS 3.1 Base Score: 8.4
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade xen | Aug 30, 2017 | May 18, 2016 |
| Debian | — | Upgrade xen | Jul 28, 2016 | May 18, 2016 |
| Freebsd | — | Upgrade xen-kernel | Dec 10, 2025 | Jul 4, 2016 |
| Suse | — | Upgrade xen-libsUpgrade xen-toolsUpgrade xen-develUpgrade xen-doc-pdfUpgrade xen-libs-32bitUpgrade xen-kmp-paeUpgrade xen-kmp-defaultUpgrade xen-kmp-traceUpgrade xen-tools-domUUpgrade xenUpgrade xen-doc-html | Oct 12, 2016 | May 18, 2016 |
| Ubuntu | — | Upgrade xen | Nov 19, 2024 | May 18, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub