#VU7146 Information disclosure in Xen - CVE-2017-10911
Published: June 21, 2017 / Updated: July 28, 2020
Vulnerability identifier: #VU7146
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2017-10911
CWE-ID: CWE-200
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerable software:
Xen
Xen
Software vendor:
Xen Project
Xen Project
Description
The vulnerability allows a local attacker to obtain potentially sensitive information from another guest system or the host system.
The weakness exists due to improper initialization of some fields of the block interface (blkif) response structure. A local attacker can read arbitrary files from stack memory.
Successful exploitation of the vulnerability results in information disclosure.
The weakness exists due to improper initialization of some fields of the block interface (blkif) response structure. A local attacker can read arbitrary files from stack memory.
Successful exploitation of the vulnerability results in information disclosure.
Remediation
Install update from vendor's website.