CVE-2017-10912 : Xen through 4.8.x mishandles page transfer, which allows guest OS users to obtain privileged host OS access, aka XSA-217

Xen through 4.8.x mishandles page transfer, which allows guest OS users to obtain privileged host OS access, aka XSA-217.

Published 2017-07-05 01:29:01

Updated 2019-10-03 00:03:26

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2017-10912

XEN » XEN
Versions up to, including, (<=) 4.8.1
cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.50%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 73 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
10.0	HIGH	AV:N/AC:L/Au:N/C:C/I:C/A:C	10.0	10.0	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
10.0	CRITICAL	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H	3.9	6.0	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: High

http://www.securitytracker.com/id/1038721

Xen Page Transfer Bug Lets Local Users on a Guest System Gain Elevated Privileges on the Host System - SecurityTracker
https://security.gentoo.org/glsa/201710-17

Xen: Multiple vulnerabilities (GLSA 201710-17) — Gentoo security

CVEs referencing this url
http://www.debian.org/security/2017/dsa-3969

Debian -- Security Information -- DSA-3969-1 xen

CVEs referencing this url
https://security.gentoo.org/glsa/201708-03

Gentoo Linux — Error 404 (Not Found)

CVEs referencing this url
https://xenbits.xen.org/xsa/advisory-217.html

XSA-217 - Xen Security Advisories
Mailing List;Mitigation;Third Party Advisory
http://www.securityfocus.com/bid/99158

Xen Page Transfer 'xen/arch/x86/mm.c' Privilege Escalation Vulnerability

Jump to