PT-2017-2971 · Xen+1 · Xen+1
Published
2017-09-12
·
Updated
2018-10-19
·
CVE-2017-14316
CVSS v3.1
8.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Xen versions prior to 4.10
Description
A parameter verification issue was discovered in the
alloc heap pages function, which allows callers to specify the first NUMA node for allocations through the memflags parameter. The function does not handle the case where the specified node is out of bounds, allowing an out-of-bounds access to an internal array. This issue may be exploited by a local attacker to execute arbitrary code or cause a denial of service by accessing memory outside the intended boundaries using the NUMA value used for memory allocation.Recommendations
For Xen versions prior to 4.10, consider restricting the use of the
alloc heap pages function until a patch is available, or apply configuration changes to limit the impact of the out-of-bounds access.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Suse
Xen