PT-2017-14117 · Citrix+1 · Xen+1

Roger Pau Monné · Published 2017-10-18 · Updated 2018-10-19 · CVE-2017-15589

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Xen versions prior to 4.10

Description An issue allows x86 HVM guest OS users to obtain sensitive information from the host OS or an arbitrary guest OS. This occurs because intercepted I/O operations can cause a write of data from uninitialized hypervisor stack memory.

Recommendations For versions prior to 4.10, update to version 4.10 or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-15589

DLA-1181-1

DLA-1549-1

DSA-4050-1

OPENSUSE-SU-2017_2821-1

OPENSUSE-SU-2017_2916-1

SUSE-SU-2017:2812-1

SUSE-SU-2017:2815-1

SUSE-SU-2017:2856-1

SUSE-SU-2017:2864-1

SUSE-SU-2017:2873-1

Affected Products

Suse

Xen

References · 49

• https://osv.dev/vulnerability/SUSE-SU-2017:2873-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4050-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-15589 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-15589 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-15589 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:2856-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-15589 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2017:2815-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-15589 · Security Note
• https://xenbits.xen.org/xsa/advisory-239.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:2864-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-15589 · Vendor Advisory
• https://security.gentoo.org/glsa/201801-14 · Vendor Advisory
• https://debian.org/security/2017/dsa-4050 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:2812-1 · Vendor Advisory