Denial of service in Xen - CVE-2017-15596
Published: August 25, 2017 / Updated: July 28, 2020
Vulnerability identifier: #VU8009
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-15596
CWE-ID: CWE-789
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local attacker on guest system to cause DoS condition on the host system.
The weakness exists due to improper memory allocation. A local attacker can trigger a flaw in the add-to-physmap function, prevent use of a physical CPU and cause the application on the host system to crash.
Successful exploitation of the vulnerability results in denial of service.
The weakness exists due to improper memory allocation. A local attacker can trigger a flaw in the add-to-physmap function, prevent use of a physical CPU and cause the application on the host system to crash.
Successful exploitation of the vulnerability results in denial of service.
Affected software
Xen
xen (Alpine package)
xen (Alpine package)
How to mitigate CVE-2017-15596
Install update from vendor's website.
xen (Alpine package) - update to 4.6.6-r2