CVE-2017-14318: Null Pointer Dereference
First published: Tue Sep 12 2017(Updated: )
An issue was discovered in Xen 4.5.x through 4.9.x. The function `__gnttab_cache_flush` handles GNTTABOP_cache_flush grant table operations. It checks to see if the calling domain is the owner of the page that is to be operated on. If it is not, the owner's grant table is checked to see if a grant mapping to the calling domain exists for the page in question. However, the function does not check to see if the owning domain actually has a grant table or not. Some special domains, such as `DOMID_XEN`, `DOMID_IO` and `DOMID_COW` are created without grant tables. Hence, if __gnttab_cache_flush operates on a page owned by these special domains, it will attempt to dereference a NULL pointer in the domain struct.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/xen | 4.11.4+107-gef32c7afa2-1 4.14.6-1 4.14.5+94-ge49571868d-1 4.17.1+2-gb773c48e36-1 4.17.2+55-g0b56bed864-1 | |
| Xen xen-unstable | =4.5.0 | |
| Xen xen-unstable | =4.5.1 | |
| Xen xen-unstable | =4.5.2 | |
| Xen xen-unstable | =4.5.3 | |
| Xen xen-unstable | =4.5.5 | |
| Xen xen-unstable | =4.6.0 | |
| Xen xen-unstable | =4.6.1 | |
| Xen xen-unstable | =4.6.3 | |
| Xen xen-unstable | =4.6.4 | |
| Xen xen-unstable | =4.6.5 | |
| Xen xen-unstable | =4.6.6 | |
| Xen xen-unstable | =4.7.0 | |
| Xen xen-unstable | =4.7.1 | |
| Xen xen-unstable | =4.7.2 | |
| Xen xen-unstable | =4.7.3 | |
| Xen xen-unstable | =4.8.0 | |
| Xen xen-unstable | =4.8.1 | |
| Xen xen-unstable | =4.9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/100817
- http://www.securitytracker.com/id/1039349
- http://xenbits.xen.org/xsa/advisory-232.html
- https://support.citrix.com/article/CTX227185
- https://www.debian.org/security/2017/dsa-4050
- https://xenbits.xen.org/xsa/advisory-232.html
- https://security-tracker.debian.org/tracker/CVE-2017-14318
Frequently Asked Questions
What is the severity of CVE-2017-14318?
CVE-2017-14318 has a high severity rating due to the potential for unauthorized access and manipulation of memory.
How do I fix CVE-2017-14318?
To fix CVE-2017-14318, upgrade to Xen versions 4.11.4, 4.14.6, or later versions that address this vulnerability.
What versions are affected by CVE-2017-14318?
CVE-2017-14318 affects Xen versions 4.5.x through 4.9.x.
What is the nature of the vulnerability in CVE-2017-14318?
CVE-2017-14318 is related to improper handling of grant table operations, potentially allowing unauthorized page access.
Can CVE-2017-14318 lead to data breaches?
Yes, CVE-2017-14318 can potentially lead to data breaches if exploited by an attacker.
- collector/security-tracker-debian
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/remedy
- agent/author
- agent/severity
- agent/references
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- package-manager/debian
- vendor/xen
- canonical/xen xen-unstable
- version/xen xen-unstable/4.5.0
- version/xen xen-unstable/4.5.1
- version/xen xen-unstable/4.5.2
- version/xen xen-unstable/4.5.3
- version/xen xen-unstable/4.5.5
- version/xen xen-unstable/4.6.0
- version/xen xen-unstable/4.6.1
- version/xen xen-unstable/4.6.3
- version/xen xen-unstable/4.6.4
- version/xen xen-unstable/4.6.5
- version/xen xen-unstable/4.6.6
- version/xen xen-unstable/4.7.0
- version/xen xen-unstable/4.7.1
- version/xen xen-unstable/4.7.2
- version/xen xen-unstable/4.7.3
- version/xen xen-unstable/4.8.0
- version/xen xen-unstable/4.8.1
- version/xen xen-unstable/4.9.0