The kvm_iommu_map_pages function in virt/kvm/iommu.c in the Linux kernel through 3.16.1 miscalculates the number of pages during the handling of a mapping failure, which allows guest OS users to (1) cause a denial of service (host OS memory corruption) or possibly have unspecified other impact by triggering a large gfn value or (2) cause a denial of service (host OS memory consumption) by triggering a small gfn value that leads to permanently pinned pages.

The kvm_iommu_map_pages function in virt/kvm/iommu.c in the Linux kernel through 3.16.1 miscalculates the number of pages during the handling of a mapping failure, which allows guest OS users to (1) cause a denial of service (host OS memory corruption) or possibly have unspecified other impact by triggering a large gfn value or (2) cause a denial of service (host OS memory consumption) by triggering a small gfn value that leads to permanently pinned pages.

libmnl: incorrect validation of netlink message origin allows attackers to spoof netlink messages kernel: integer overflow in fb_mmap kernel: ipc: ipc_rcu_putref refcount races kernel: net: insufficient permision checks of netlink messages Kernel: mm: try_to_unmap_cluster() should lock_page() before mlocking kernel: kvm: invalid parameter passing in kvm_iommu_map_pages() kernel: lzo1x_decompress_safe() integer overflow Kernel: ALSA: control: do not access controls outside of protected regions Kernel: ALSA: control: use-after-free in replacing user controls Kernel: ALSA: control: use-after-free in replacing user controls kernel: vfs: refcount issues during unmount on symlink Kernel: net: SCTP: fix a NULL pointer dereference during INIT collisions

Security update for Linux kernel

Affected: Ubuntu:14.04:LTS: linux

The kvm_iommu_map_pages function in virt/kvm/iommu.c in the Linux kernel through 3.16.1 miscalculates the number of pages during the handling of a mapping failure, which allows guest OS users to (1) cause a denial of service (host OS memory corruption) or possibly have unspecified other impact by triggering a large gfn value or (2) cause a denial of service (host OS memory consumption) by triggering a small gfn value that leads to permanently pinned pages.