Null pointer dereference in Xen - CVE-2017-14318
Published: September 14, 2017
Vulnerability identifier: #VU8425
CSH Severity: Low
CVSS v4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-14318
CWE-ID: CWE-476
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an adjacent attacker to gain elevated privileges or cause DoS condition on the host system.
The weakness exists due to NULL pointer deference in certain GNTTABOP_cache_flush grant table operations. If exploited on x86-based PV guest systems without SMAP enabled, an adjacent attacker can gain elevated privileges. If exploited on ARM-based guest systems and x86-based PV guest systems that have SMAP enabled, an adjacent attacker can cause the host system to crash.
The weakness exists due to NULL pointer deference in certain GNTTABOP_cache_flush grant table operations. If exploited on x86-based PV guest systems without SMAP enabled, an adjacent attacker can gain elevated privileges. If exploited on ARM-based guest systems and x86-based PV guest systems that have SMAP enabled, an adjacent attacker can cause the host system to crash.
Affected software
Xen
Debian Linux
SUSE Linux
Fedora
xen (Alpine package)
xen
Debian Linux
SUSE Linux
Fedora
xen (Alpine package)
xen
How to mitigate CVE-2017-14318
Install update from vendor's website.
xen (Alpine package) - addressed in versions 4.6.3-r9, 4.6.3-r11
xen - addressed in versions 4.7.3-5.fc25, 4.8.2-2.fc26, 4.9.0-10.fc27
xen - addressed in versions 4.7.3-5.fc25, 4.8.2-2.fc26, 4.9.0-10.fc27