PT-2017-18056 · Xen+1 · Xen+1

Jan Beulich · Publicado 2017-05-02 · Atualizado 2017-05-15 · CVE-2017-7995

Positive Technologies (AI Summary)

CVSS v3.1

3.8

Baixa

Vetor base

AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Xen versions prior to 4.5.x

Description The issue arises from inadequate access permission checks for MMIO ranges in Xen PV guests, specifically an error in the get user function. This allows unauthorized reads of host PCI device space memory, potentially leading to information disclosure.

Recommendations For versions prior to 4.5.x, update to a version 4.5.x or later to resolve the issue.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2017-7995

DLA-964-1

SUSE-SU-2017:1146-1

Produtos afetados

Suse

Xen

Referências · 20

• https://bugzilla.suse.com/1034843 · Nota
• https://suse.com/security/cve/CVE-2017-7718 · Nota
• https://suse.com/security/cve/CVE-2017-7995 · Nota
• https://suse.com/security/cve/CVE-2016-9603 · Nota
• https://bugzilla.suse.com/show_bug.cgi?id=1033948 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2017:1146-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-7995 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2017-7995 · Aviso do Fabricante
• https://bugzilla.suse.com/1028655 · Nota
• https://bugzilla.suse.com/1034994 · Nota
• https://bugzilla.suse.com/1034845 · Nota
• https://suse.com/security/cve/CVE-2017-7980 · Nota
• https://bugzilla.suse.com/1035483 · Nota
• https://bugzilla.suse.com/1033948 · Nota
• http://securityfocus.com/bid/98314 · Nota