Resource exhaustion in Xen - CVE-2017-15595

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU9452

Resource exhaustion in Xen - CVE-2017-15595

Published: November 29, 2017


Vulnerability identifier: #VU9452
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-15595
CWE-ID: CWE-400
Exploitation vector: Adjecent network
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows an adjacent attacker to gain elevated privileges or cause DoS conditions on the target system.

The weakness exists due to improper input validation. An adjacent attacker can supply specially crafted page-table stacking, trigger unbounded recursion, stack consumption, gain elevated privileges or cause hypervisor crash.

Affected software

Xen
Debian Linux
Gentoo Linux
SUSE Linux
Fedora
xen (Alpine package)
xen (Debian package)
xen

How to mitigate CVE-2017-15595

Install update from vendor's website.

xen (Alpine package) - update to 4.6.6-r2
xen (Debian package) - update to 4.8.5+shim4.10.2+xsa282-1+deb9u11
xen - addressed in versions 4.7.3-7.fc25, 4.7.3-9.fc25, 4.7.4-1.fc25, 4.8.2-4.fc26, 4.8.2-7.fc26, 4.8.2-9.fc26, 4.9.0-12.fc27, 4.9.0-14.fc27, 4.9.1-4.fc27

External References

Related Security Bulletins