CVE-2017-15589 : An issue was discovered in Xen through 4.9.x allowing x86 HVM guest OS users to

An issue was discovered in Xen through 4.9.x allowing x86 HVM guest OS users to obtain sensitive information from the host OS (or an arbitrary guest OS) because intercepted I/O operations can cause a write of data from uninitialized hypervisor stack memory.

Published 2017-10-18 08:29:00

Updated 2018-10-19 10:29:04

Source MITRE

View at NVD, CVE.org

Vulnerability category: Information leak

Products affected by CVE-2017-15589

XEN » XEN » Version: 4.9.0
cpe:2.3:o:xen:xen:4.9.0:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2017-15589

EPSS FAQ

0.06%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 27 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2017-15589

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
2.1	LOW	AV:L/AC:L/Au:N/C:P/I:N/A:N	3.9	2.9	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
6.5	MEDIUM	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N	2.0	4.0	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Changed Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2017-15589

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2017-15589

https://lists.debian.org/debian-lts-announce/2017/11/msg00027.html

[SECURITY] [DLA 1181-1] xen security update

CVEs referencing this url
http://www.securitytracker.com/id/1039568

Xen Multiple Flaws on x86 Systems Let Local Guest System Users Obtain Memory Contents and Potentially Sensitive Information, Deny Service on the Host System, and Gain Elevated Privileges on the Host S
Third Party Advisory;VDB Entry

CVEs referencing this url
https://support.citrix.com/article/CTX228867

Citrix XenServer Multiple Security Updates

CVEs referencing this url
https://www.debian.org/security/2017/dsa-4050

Debian -- Security Information -- DSA-4050-1 xen

CVEs referencing this url
https://lists.debian.org/debian-lts-announce/2018/10/msg00009.html

[SECURITY] [DLA 1549-1] xen security update

CVEs referencing this url
https://security.gentoo.org/glsa/201801-14

Xen: Multiple vulnerabilities (GLSA 201801-14) — Gentoo security

CVEs referencing this url
https://xenbits.xen.org/xsa/advisory-239.html

XSA-239 - Xen Security Advisories
Mailing List;Mitigation;Patch;Vendor Advisory
http://www.securityfocus.com/bid/101496

Xen CVE-2017-15589 Information Disclosure Vulnerability
Third Party Advisory;VDB Entry

Jump to

Vulnerability Details : CVE-2017-15589

Products affected by CVE-2017-15589

Exploit prediction scoring system (EPSS) score for CVE-2017-15589

CVSS scores for CVE-2017-15589

CWE ids for CVE-2017-15589

References for CVE-2017-15589