CVE-2017-15588: Race Condition

Published Oct 18, 2017

Updated

An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to execute arbitrary code on the host OS because of a race condition that can cause a stale TLB entry.

Affected Software

2 affected componentsFixes available

debian/xen

4.11.4+107-gef32c7afa2-14.14.6-14.14.5+94-ge49571868d-14.17.1+2-gb773c48e36-14.17.2+55-g0b56bed864-1

XEN Xen=4.9.0

Remediation

Patch Available

https://xenbits.xen.org/xsa/advisory-241.html

Event History

Oct 18, 2017

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2017-15588?

CVE-2017-15588 has a high severity rating due to its potential to allow arbitrary code execution on the host OS by x86 PV guest OS users.

How do I fix CVE-2017-15588?

To fix CVE-2017-15588, update to affected Xen versions 4.11.4+107-gef32c7afa2-1, 4.14.6-1, 4.14.5+94-ge49571868d-1, 4.17.1+2-gb773c48e36-1, or 4.17.2+55-g0b56bed864-1.

What versions of Xen are affected by CVE-2017-15588?

CVE-2017-15588 affects all Xen versions below 4.11.4 and those specifically identified, including 4.9.x.

Who is affected by CVE-2017-15588?

Users of Xen hypervisors, particularly those running x86 PV guest operating systems, are affected by CVE-2017-15588.

Is there a workaround for CVE-2017-15588?

No definitive workaround exists for CVE-2017-15588; the recommended action is to apply the available updates.