Debian update for xen
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 12 |
| CVE-ID | CVE-2017-14316 CVE-2017-14317 CVE-2017-14318 CVE-2017-14319 CVE-2017-15588 CVE-2017-15589 CVE-2017-15590 CVE-2017-15592 CVE-2017-15593 CVE-2017-15594 CVE-2017-15595 CVE-2017-15597 |
| CWE-ID | CWE-787 CWE-362 CWE-476 CWE-264 CWE-401 CWE-284 CWE-400 |
| Exploitation vector | Local network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
Debian Linux Operating systems & Components / Operating system |
| Vendor | Debian |
Security Bulletin
This security bulletin contains information about 12 vulnerabilities.
1) Out-of-bounds write
EUVDB-ID: #VU8424
Risk: Low
CVSSv3.1: 8.3 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-14316
CWE-ID:
CWE-787 - Out-of-bounds write
Exploit availability: No
DescriptionThe vulnerability allows an adjacent attacker to execute arbitrary code on the host system.
The weakness exists due to out-of-bounds array access in the processing of NUMA node
parameters. An adjacent attacker can invoke specially crafted hypercalls and execute arbitrary code with elevated privileges.
Update the affected package to version: 4.8.2+xsa245-0+deb9u1
Vulnerable software versionsDebian Linux: All versions
External linkshttp://xenbits.xen.org/xsa/advisory-231.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Race condition
EUVDB-ID: #VU8426
Risk: Low
CVSSv3.1: 5.7 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-14317
Exploit availability: No
DescriptionThe vulnerability allows an adjacent attacker to cause DoS condition on the host system.
The weakness exists due to race condition in cxenstored. An adjacent attacker can shut down a virtual machine with a stubdomain, trigger a double-free memory error and cause the xenstored daemon to crash.
The vulnerability is exploitable on the systems running the C
version os xenstored ("xenstored") and running devicemodel stubdomains.
Update the affected package to version: 4.8.2+xsa245-0+deb9u1
Vulnerable software versionsDebian Linux: All versions
External linkshttp://xenbits.xen.org/xsa/advisory-233.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Null pointer dereference
EUVDB-ID: #VU8425
Risk: Low
CVSSv3.1: 7.7 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-14318
CWE-ID:
CWE-476 - NULL Pointer Dereference
Exploit availability: No
DescriptionThe vulnerability allows an adjacent attacker to gain elevated privileges or cause DoS condition on the host system.
The weakness exists due to NULL pointer deference in certain GNTTABOP_cache_flush grant table operations. If exploited on x86-based PV guest systems without SMAP enabled, an adjacent attacker can gain elevated privileges. If exploited on ARM-based guest systems and x86-based PV guest systems that have SMAP enabled, an adjacent attacker can cause the host system to crash.
Update the affected package to version: 4.8.2+xsa245-0+deb9u1
Vulnerable software versionsDebian Linux: All versions
External linkshttp://xenbits.xen.org/xsa/advisory-232.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Privilege escalation
EUVDB-ID: #VU8427
Risk: Low
CVSSv3.1: 7.7 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-14319
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows an adjacent attacker to gain elevated privileges or cause DoS condition on the host system.
The weakness exists due to a flaw in grant unmapping. A local attacker on
an x86 PV guest system can gain
elevated privileges on the host system or cause the hypervisor to crash.
Update the affected package to version: 4.8.2+xsa245-0+deb9u1
Vulnerable software versionsDebian Linux: All versions
External linkshttp://xenbits.xen.org/xsa/advisory-234.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
5) Race condition
EUVDB-ID: #VU9446
Risk: Low
CVSSv3.1: 8.3 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-15588
Exploit availability: No
DescriptionThe vulnerability allows an adjacent attacker to gain elevated privileges on the target system.
The weakness exists due to page type release race. An adjacent attacker can supply a stale TLB entry, trigger race condition and execute arbitrary code with elevated privileges.
Update the affected package to version: 4.8.2+xsa245-0+deb9u1
Vulnerable software versionsDebian Linux: All versions
External linkshttp://xenbits.xen.org/xsa/advisory-241.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
6) Memory leak
EUVDB-ID: #VU9447
Risk: Low
CVSSv3.1: 3.8 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-15589
CWE-ID:
CWE-401 - Missing release of memory after effective lifetime
Exploit availability: No
DescriptionThe vulnerability allows an adjacent attacker to obtain potentially sensitive information on the target system.
The weakness exists due to hypervisor stack leak in x86 I/O intercept code. An adjacent attacker can write data from uninitialized hypervisor stack memory and read arbitrary information.
Update the affected package to version: 4.8.2+xsa245-0+deb9u1
Vulnerable software versionsDebian Linux: All versions
External linkshttp://xenbits.xen.org/xsa/advisory-239.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
7) Improper access control
EUVDB-ID: #VU9448
Risk: Low
CVSSv3.1: 5.7 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-15590
CWE-ID:
CWE-284 - Improper Access Control
Exploit availability: No
DescriptionThe vulnerability allows an adjacent attacker to cause DoS conditions on the target system.
The weakness exists due to an error with the setup of PCI MSI interrupts. An adjacent attacker can supply MSI and cause the hypervisor to crash.
Update the affected package to version: 4.8.2+xsa245-0+deb9u1
Vulnerable software versionsDebian Linux: All versions
External linkshttp://xenbits.xen.org/xsa/advisory-237.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
8) Privilege escalation
EUVDB-ID: #VU9449
Risk: Low
CVSSv3.1: 6.6 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-15592
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows an adjacent attacker to cause DoS conditions or gain elevated privileges on the target system.
The weakness exists due to mishandling of self-linear shadow mappings for translated guests. An adjacent attacker can supply self-linear shadow mappings and cause the hypervisor to crash or possibly gain elevated privileges.
Update the affected package to version: 4.8.2+xsa245-0+deb9u1
Vulnerable software versionsDebian Linux: All versions
External linkshttp://xenbits.xen.org/xsa/advisory-243.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
9) Memory leak
EUVDB-ID: #VU9450
Risk: Low
CVSSv3.1: 5.7 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-15593
CWE-ID:
CWE-401 - Missing release of memory after effective lifetime
Exploit availability: No
DescriptionThe vulnerability allows an adjacent attacker to cause DoS conditions on the target system.
The weakness exists due to mishandling of reference counts. An adjacent attacker can trigger memory leak and cause the service to crash.
Update the affected package to version: 4.8.2+xsa245-0+deb9u1
Vulnerable software versionsDebian Linux: All versions
External linkshttp://xenbits.xen.org/xsa/advisory-242.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
10) Privilege escalation
EUVDB-ID: #VU9451
Risk: Low
CVSSv3.1: 4.7 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-15594
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows an adjacent attacker to gain elevated privileges or cause DoS conditions on the target system.
The weakness exists due to mishandling of IDT settings during CPU hotplugging. An adjacent attacker can gain elevated privileges or cause hypervisor crash.
Update the affected package to version: 4.8.2+xsa245-0+deb9u1
Vulnerable software versionsDebian Linux: All versions
External linkshttp://xenbits.xen.org/xsa/advisory-244.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
11) Resource exhaustion
EUVDB-ID: #VU9452
Risk: Low
CVSSv3.1: 4.7 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-15595
CWE-ID:
CWE-400 - Resource exhaustion
Exploit availability: No
DescriptionThe vulnerability allows an adjacent attacker to gain elevated privileges or cause DoS conditions on the target system.
The weakness exists due to improper input validation. An adjacent attacker can supply specially crafted page-table stacking, trigger unbounded recursion, stack consumption, gain elevated privileges or cause hypervisor crash.
Update the affected package to version: 4.8.2+xsa245-0+deb9u1
Vulnerable software versionsDebian Linux: All versions
External linkshttp://xenbits.xen.org/xsa/advisory-240.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
12) Race condition
EUVDB-ID: #VU8923
Risk: Low
CVSSv3.1: 2.1 [CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-15597
Exploit availability: No
DescriptionThe vulnerability allows an adjacent administrative attacker to cause DoS condition on the target system.
The weakness exists due to a race condition in certain grant copy operations. A local attacker can trigger a memory corruption error in the hypervisor and cause the application to crash.
Successful exploitation of the vulnerability results in denial of service.
Update the affected package to version: 4.8.2+xsa245-0+deb9u1
Vulnerable software versionsDebian Linux: All versions
External linkshttp://xenbits.xen.org/xsa/advisory-236.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
