Privilege escalation in Xen - CVE-2017-10912

Vulnerability identifier: #VU7499

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-10912

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to gain elevated privileges.

The weakness exists due to improper handling of page transfer. A local OS attacker can gain host privileges on the target system.

Successful exploitation of the vulnerability results in privilege escalation.

Xen
Gentoo Linux
Fedora
Opensuse
xen (Alpine package)
xen

Install update from vendor's website.

xen (Alpine package) - update to 4.8.2-r0
xen - addressed in versions 4.6.5-7.fc24, 4.7.2-7.fc25, 4.8.1-4.fc26

• https://xenbits.xen.org/xsa/advisory-217.html

• Multiple vulnerabilities in Xen
• openSUSE update for Xen
• Gentoo update for Xen
• Privilege escalation in xen (Alpine package)
• Gentoo update for Xen
• Fedora 26 update for xen
• Fedora 25 update for xen
• Fedora 24 update for xen