Privilege escalation in Xen - CVE-2017-12134

 

Privilege escalation in Xen - CVE-2017-12134

Published: August 16, 2017


Vulnerability identifier: #VU7952
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2017-12134
CWE-ID: CWE-264
Exploitation vector: Adjecent network
Exploit availability: No public exploit available
Vendor: Xen Project
Affected software:
Xen

Detailed vulnerability description

The vulnerability allows a local attacker on a Linux-based guest system to gain elevated privileges on the host system.

The weakness exists due to aa flaw in merging adjacent block IO requests. A local attacker on the guest system can incorrectly access memory during block stream processing to obtain potentially sensitive information or gain elevated privileges on the host system.

How to mitigate CVE-2017-12134

Install update from vendor's website.

Sources