Memory leak in Xen - CVE-2017-15589
Published: November 29, 2017
Vulnerability identifier: #VU9447
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-15589
CWE-ID: CWE-401
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an adjacent attacker to obtain potentially sensitive information on the target system.
The weakness exists due to hypervisor stack leak in x86 I/O intercept code. An adjacent attacker can write data from uninitialized hypervisor stack memory and read arbitrary information.
The weakness exists due to hypervisor stack leak in x86 I/O intercept code. An adjacent attacker can write data from uninitialized hypervisor stack memory and read arbitrary information.
Affected software
Xen
Debian Linux
Gentoo Linux
Fedora
xen (Alpine package)
xen
Debian Linux
Gentoo Linux
Fedora
xen (Alpine package)
xen
How to mitigate CVE-2017-15589
Install update from vendor's website.
xen (Alpine package) - update to 4.6.6-r2
xen - addressed in versions 4.7.3-7.fc25, 4.7.3-9.fc25, 4.7.4-1.fc25, 4.8.2-4.fc26, 4.9.0-12.fc27, 4.9.0-14.fc27
xen - addressed in versions 4.7.3-7.fc25, 4.7.3-9.fc25, 4.7.4-1.fc25, 4.8.2-4.fc26, 4.9.0-12.fc27, 4.9.0-14.fc27