SB2018010537 - Privilege escalation in xen (Alpine package)
Published: January 5, 2018
Security Bulletin ID
SB2018010537
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Adjecent network
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Privilege escalation (CVE-ID: CVE-2017-15594)
CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls
CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows an adjacent attacker to gain elevated privileges or cause DoS conditions on the target system.
The weakness exists due to mishandling of IDT settings during CPU hotplugging. An adjacent attacker can gain elevated privileges or cause hypervisor crash.
Remediation
Install update from vendor's website.