Privilege escalation in Xen - CVE-2017-15592

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU9449

Privilege escalation in Xen - CVE-2017-15592

Published: November 29, 2017


Vulnerability identifier: #VU9449
CSH Severity: Low
CVSS v4: 7.2 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-15592
CWE-ID: CWE-264
Exploitation vector: Adjecent network
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows an adjacent attacker to cause DoS conditions or gain elevated privileges on the target system.

The weakness exists due to mishandling of self-linear shadow mappings for translated guests. An adjacent attacker can supply self-linear shadow mappings and cause the hypervisor to crash or possibly gain elevated privileges.

Affected software

Xen
Debian Linux
Gentoo Linux
SUSE Linux
Fedora
xen (Alpine package)
xen

How to mitigate CVE-2017-15592

Install update from vendor's website.

xen (Alpine package) - update to 4.6.6-r2
xen - addressed in versions 4.7.3-7.fc25, 4.7.3-9.fc25, 4.7.4-1.fc25, 4.8.2-4.fc26, 4.8.2-7.fc26, 4.9.0-12.fc27, 4.9.0-14.fc27

External References

Related Security Bulletins