CVE-2017-10923: Input Validation
Published Jul 5, 2017
·Updated
Xen through 4.8.x does not validate a vCPU array index upon the sending of an SGI, which allows guest OS users to cause a denial of service (hypervisor crash), aka XSA-225.
Affected Software
8 affected components
XEN Xen=4.6.0
XEN Xen=4.6.1
XEN Xen=4.6.2
XEN Xen=4.6.4
XEN Xen=4.6.5
XEN Xen=4.7.1
XEN Xen=4.8.0
XEN Xen=4.8.1
Event History
Jul 5, 2017
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-10923?
CVE-2017-10923 has been rated as a high-severity vulnerability due to its potential to cause a denial of service in the hypervisor.
2
How do I fix CVE-2017-10923?
To mitigate CVE-2017-10923, upgrade your Xen installation to the latest version that addresses the vulnerability.
3
What impact does CVE-2017-10923 have on affected systems?
CVE-2017-10923 can lead to a hypervisor crash, resulting in service disruption for guest operating systems.
4
Which versions of Xen are affected by CVE-2017-10923?
Xen versions 4.6.0 through 4.8.1 are affected by CVE-2017-10923.
5
Is there a workaround for CVE-2017-10923?
There is no known workaround for CVE-2017-10923; patching to a secured version is recommended.