Denial of service in Xen - CVE-2017-10919
Published: June 21, 2017 / Updated: July 28, 2020
Vulnerability identifier: #VU7152
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-10919
CWE-ID: CWE-284
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local attacker to cause DoS condition on the host system.
The weakness exists due to missing check. A local attacker can send a software generated interrupt to a vCPU or configure timers and cause the host system to crash.
Successful exploitation of the vulnerability results in denial of service.
The weakness exists due to missing check. A local attacker can send a software generated interrupt to a vCPU or configure timers and cause the host system to crash.
Successful exploitation of the vulnerability results in denial of service.
Affected software
Xen
Gentoo Linux
Fedora
xen (Alpine package)
xen
Gentoo Linux
Fedora
xen (Alpine package)
xen
How to mitigate CVE-2017-10919
Install update from vendor's website.
xen (Alpine package) - update to 4.8.2-r0
xen - addressed in versions 4.6.5-7.fc24, 4.7.2-7.fc25, 4.8.1-4.fc26
xen - addressed in versions 4.6.5-7.fc24, 4.7.2-7.fc25, 4.8.1-4.fc26