PT-2017-2369 · Xen+2 · Xen+2

Jann Horn · Published 2017-04-04 · Updated 2019-10-03 · CVE-2017-7228

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Xen versions 4.4.x through 4.8.x

Description The issue is related to inadequate access control in the Xen hypervisor. It allows a local attacker to access hypervisor memory outside of the guest-provided input/output arrays due to insufficient checking of XENMEM exchange input, which was introduced by the earlier XSA-29 fix.

Recommendations For versions 4.4.x through 4.8.x, apply the available fixes to resolve the issue. As a temporary workaround, consider restricting access to the XENMEM exchange input to minimize the risk of exploitation.

Exploit

Fix

Improper Validation of Array Index

Improper Access Control

Weakness Enumeration

CWE-129

CWE-284

Related Identifiers

ALT-PU-2017-1483

BDU:2017-01569

CVE-2017-7228

DLA-907-1

DSA-3847-1

OPENSUSE-SU-2017_1078-1

SUSE-SU-2017:0983-1

SUSE-SU-2017:1058-1

SUSE-SU-2017:1080-1

SUSE-SU-2017:1081-1

Affected Products

Alt Linux

Suse

Xen

References · 62

• 🔥 https://exploit-db.com/exploits/41870 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7228 · Security Note
• http://debian.org/security/2017/dsa-3847 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-3847-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:1058-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/xen · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2017-1483 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-01291 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-7228 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:0983-1 · Vendor Advisory
• http://xenbits.xen.org/xsa/advisory-212.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-7228 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-7228 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10024 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2017-7228 · Vendor Advisory