PT-2017-18056 · Xen+1 · Xen+1

Jan Beulich · Published 2017-05-02 · Updated 2017-05-15 · CVE-2017-7995

Positive Technologies (AI Summary)

CVSS v3.1

3.8

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Xen versions prior to 4.5.x

Description The issue arises from inadequate access permission checks for MMIO ranges in Xen PV guests, specifically an error in the get user function. This allows unauthorized reads of host PCI device space memory, potentially leading to information disclosure.

Recommendations For versions prior to 4.5.x, update to a version 4.5.x or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-7995

DLA-964-1

SUSE-SU-2017:1146-1

Affected Products

Suse

Xen

References · 20

• https://osv.dev/vulnerability/SUSE-SU-2017:1146-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-7995 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-7995 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7995 · Security Note
• https://osv.dev/vulnerability/CVE-2017-7995 · Vendor Advisory
• https://bugzilla.suse.com/1034843 · Note
• https://suse.com/security/cve/CVE-2017-7718 · Note
• https://suse.com/security/cve/CVE-2017-7995 · Note
• https://suse.com/security/cve/CVE-2016-9603 · Note
• https://bugzilla.suse.com/show_bug.cgi?id=1033948 · Note
• https://bugzilla.suse.com/1028655 · Note
• https://bugzilla.suse.com/1034994 · Note
• https://bugzilla.suse.com/1034845 · Note
• https://suse.com/security/cve/CVE-2017-7980 · Note
• https://bugzilla.suse.com/1035483 · Note