PT-2017-2433 · Xen+1 · Xen+1

Ankur Arora · Publicado 2017-07-05 · Atualizado 2017-11-04 · CVE-2017-10917

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions Xen versions prior to 4.9

Description The issue is related to insufficient validation of port numbers of polled event channel ports. This can be exploited by guest OS users to cause a denial of service, resulting in a NULL pointer dereference and host OS crash, or possibly obtain sensitive information.

Recommendations For Xen versions prior to 4.9, update to version 4.9 or later to resolve the issue. At the moment, there is no information about other versions that contain a fix for this issue.

Correção

DoS

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

BDU:2017-01638

CVE-2017-10917

DSA-3969-1

OPENSUSE-SU-2017_1826-1

SUSE-SU-2017:1795-1

SUSE-SU-2017:1812-1

Produtos afetados

Suse

Xen

Referências · 56

• https://suse.com/security/cve/CVE-2017-10918 · Nota
• https://security-tracker.debian.org/tracker/CVE-2017-10917 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2017-8309 · Nota
• https://bugzilla.suse.com/1027519 · Nota
• https://suse.com/security/cve/CVE-2017-8905 · Nota
• https://bdu.fstec.ru/vul/2017-01638 · Nota de Segurança
• https://bugzilla.suse.com/1042924 · Nota
• https://bugzilla.suse.com/1042160 · Nota
• http://debian.org/security/2017/dsa-3969 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-10917 · Aviso do Fabricante
• https://bugzilla.suse.com/1042938 · Nota
• https://suse.com/security/cve/CVE-2017-9374 · Nota
• http://securitytracker.com/id/1038731 · Nota
• https://bugzilla.suse.com/1042931 · Nota
• https://osv.dev/vulnerability/CVE-2017-10917 · Aviso do Fabricante