PT-2017-2971 · Xen+1 · Xen+1
Publicado
2017-09-12
·
Atualizado
2018-10-19
·
CVE-2017-14316
CVSS v3.1
8.8
Alta
| Vetor | AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Xen versions prior to 4.10
Description
A parameter verification issue was discovered in the
alloc heap pages function, which allows callers to specify the first NUMA node for allocations through the memflags parameter. The function does not handle the case where the specified node is out of bounds, allowing an out-of-bounds access to an internal array. This issue may be exploited by a local attacker to execute arbitrary code or cause a denial of service by accessing memory outside the intended boundaries using the NUMA value used for memory allocation.Recommendations
For Xen versions prior to 4.10, consider restricting the use of the
alloc heap pages function until a patch is available, or apply configuration changes to limit the impact of the out-of-bounds access.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Out of bounds Read
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Suse
Xen