Information disclosure in Xen - CVE-2017-10911

 

Information disclosure in Xen - CVE-2017-10911

Published: June 21, 2017 / Updated: July 28, 2020


Vulnerability identifier: #VU7146
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-10911
CWE-ID: CWE-200
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local attacker to obtain potentially sensitive information from another guest system or the host system.

The weakness exists due to improper initialization of some fields of the block interface (blkif) response structure. A local attacker can read arbitrary files from stack memory.

Successful exploitation of the vulnerability results in information disclosure.

Affected software

Xen
Gentoo Linux
Fedora
xen (Alpine package)
xen

How to mitigate CVE-2017-10911

Install update from vendor's website.

xen (Alpine package) - update to 4.8.2-r0
xen - addressed in versions 4.6.5-7.fc24, 4.7.2-7.fc25, 4.8.1-4.fc26

External References

Related Security Bulletins