CVE-2017-10916: Infoleak
First published: Wed Jul 05 2017(Updated: )
The vCPU context-switch implementation in Xen through 4.8.x improperly interacts with the Memory Protection Extensions (MPX) and Protection Key (PKU) features, which makes it easier for guest OS users to defeat ASLR and other protection mechanisms, aka XSA-220.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Xen xen-unstable | =4.5.0 | |
| Xen xen-unstable | =4.5.1 | |
| Xen xen-unstable | =4.5.2 | |
| Xen xen-unstable | =4.5.3 | |
| Xen xen-unstable | =4.5.5 | |
| Xen xen-unstable | =4.6.0 | |
| Xen xen-unstable | =4.6.1 | |
| Xen xen-unstable | =4.6.2 | |
| Xen xen-unstable | =4.6.4 | |
| Xen xen-unstable | =4.6.5 | |
| Xen xen-unstable | =4.7.1 | |
| Xen xen-unstable | =4.8.0 | |
| Xen xen-unstable | =4.8.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2017-10916?
CVE-2017-10916 is classified as a medium-severity vulnerability due to its potential to weaken memory protection mechanisms.
How do I fix CVE-2017-10916?
To fix CVE-2017-10916, upgrade to a Xen version that is patched against this vulnerability.
What systems are affected by CVE-2017-10916?
CVE-2017-10916 affects various versions of Xen, specifically versions 4.5.0 to 4.8.1.
What types of attacks can exploit CVE-2017-10916?
CVE-2017-10916 can be exploited by guest OS users to bypass ASLR and other security protections.
What are the implications of CVE-2017-10916 in a virtualized environment?
CVE-2017-10916 may allow attackers to undermine the isolation between virtual machines, potentially leading to data breaches.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/references
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/xen
- canonical/xen xen-unstable
- version/xen xen-unstable/4.5.0
- version/xen xen-unstable/4.5.1
- version/xen xen-unstable/4.5.2
- version/xen xen-unstable/4.5.3
- version/xen xen-unstable/4.5.5
- version/xen xen-unstable/4.6.0
- version/xen xen-unstable/4.6.1
- version/xen xen-unstable/4.6.2
- version/xen xen-unstable/4.6.4
- version/xen xen-unstable/4.6.5
- version/xen xen-unstable/4.7.1
- version/xen xen-unstable/4.8.0
- version/xen xen-unstable/4.8.1