Denial of service in Xen

1) Denial of service

EUVDB-ID: #VU8009

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-15596

CWE-ID: CWE-789 - Uncontrolled Memory Allocation

Exploit availability: No

Description

The vulnerability allows a local attacker on guest system to cause DoS condition on the host system.

The weakness exists due to improper memory allocation. A local attacker can trigger a flaw in the add-to-physmap function, prevent use of a physical CPU and cause the application on the host system to crash.

Successful exploitation of the vulnerability results in denial of service.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Xen: 4.4.0 - 4.9.0

CPE2.3

• cpe:2.3:a:xen_project:xen:4.4.0:*:*:*:*:*:*:*
• cpe:2.3:a:xen_project:xen:4.4.1:*:*:*:*:*:*:*
• cpe:2.3:a:xen_project:xen:4.4.2:*:*:*:*:*:*:*

External links

https://xenbits.xen.org/xsa/advisory-235.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.