Privilege escalation in Xen - CVE-2017-12134
Published: August 16, 2017
Vulnerability identifier: #VU7952
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-12134
CWE-ID: CWE-264
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local attacker on a Linux-based guest system to gain elevated privileges on the host system.
The weakness exists due to aa flaw in merging adjacent block IO requests. A local attacker on the guest system can incorrectly access memory during block stream processing to obtain potentially sensitive information or gain elevated privileges on the host system.
The weakness exists due to aa flaw in merging adjacent block IO requests. A local attacker on the guest system can incorrectly access memory during block stream processing to obtain potentially sensitive information or gain elevated privileges on the host system.
Affected software
Xen
Amazon Linux AMI
Gentoo Linux
SUSE Linux
Ubuntu
Fedora
kernel
Amazon Linux AMI
Gentoo Linux
SUSE Linux
Ubuntu
Fedora
kernel
How to mitigate CVE-2017-12134
Install update from vendor's website.
kernel - addressed in versions 4.12.8-200.fc25, 4.12.8-300.fc26
External References
Related Security Bulletins
- Privilege escalation in Xen
- Amazon Linux AMI update for kernel
- OpenSUSE Linux update for the Linux Kernel
- Ubuntu update for Linux kernel
- Ubuntu update for Linux kernel (Xenial HWE)
- OpenSUSE Linux update for the Linux Kernel
- SUSE Linux update for the Linux Kernel
- Gentoo update for Xen
- Fedora 26 update for kernel
- Fedora 25 update for kernel