CVE-2017-14316: High severity xen xapi vulnerability
A parameter verification issue was discovered in Xen through 4.9.x. The function allocheappages allows callers to specify the first NUMA node that should be used for allocations through the memflags parameter; the node is extracted using the MEMFgetnode macro. While the function checks to see if the special constant NUMANONODE is specified, it otherwise does not handle the case where node >= MAXNUMNODES. This allows an out-of-bounds access to an internal array.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-14316?
The severity of CVE-2017-14316 is classified as high due to the parameter verification issue that could lead to unauthorized memory access.
How do I fix CVE-2017-14316?
To fix CVE-2017-14316, upgrade to Xen version 4.11.4+107-gef32c7afa2-1 or later.
Which versions of Xen are affected by CVE-2017-14316?
CVE-2017-14316 affects Xen versions up to and including 4.9.x.
What components of Xen are impacted by CVE-2017-14316?
CVE-2017-14316 impacts the `alloc_heap_pages` function within the Xen hypervisor.
Is CVE-2017-14316 exploitable remotely?
CVE-2017-14316 is considered exploitable locally by an attacker who has access to the Xen hypervisor.