PT-2017-2433 · Xen+1 · Xen+1

Ankur Arora · Published 2017-07-05 · Updated 2017-11-04 · CVE-2017-10917

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions Xen versions prior to 4.9

Description The issue is related to insufficient validation of port numbers of polled event channel ports. This can be exploited by guest OS users to cause a denial of service, resulting in a NULL pointer dereference and host OS crash, or possibly obtain sensitive information.

Recommendations For Xen versions prior to 4.9, update to version 4.9 or later to resolve the issue. At the moment, there is no information about other versions that contain a fix for this issue.

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BDU:2017-01638

CVE-2017-10917

DSA-3969-1

OPENSUSE-SU-2017_1826-1

SUSE-SU-2017:1795-1

SUSE-SU-2017:1812-1

Affected Products

Suse

Xen

References · 56

• https://security-tracker.debian.org/tracker/CVE-2017-10917 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-01638 · Security Note
• http://debian.org/security/2017/dsa-3969 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-10917 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-10917 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3969-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:1795-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2017-10917 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-10917 · Vendor Advisory
• https://security.gentoo.org/glsa/201708-03 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-10917 · Security Note
• https://cve.org/CVERecord?id=CVE-2017-10917 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2017:1812-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-10917 · Vendor Advisory
• https://suse.com/security/cve/CVE-2017-10918 · Note