CVE-2017-10916
CVE-2017-10916
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The vCPU context-switch implementation in Xen through 4.8.x improperly interacts with the Memory Protection Extensions (MPX) and Protection Key (PKU) features, which makes it easier for guest OS users to defeat ASLR and other protection mechanisms, aka XSA-220.
CVSS 7.5 · High · EPSS 1.3% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
xen Debian:12
- Affected ranges
- ECOSYSTEM: < 4.8.1-1+deb9u3
Update to 4.8.1-1+deb9u3
xen Debian:13
- Affected ranges
- ECOSYSTEM: < 4.8.1-1+deb9u3
Update to 4.8.1-1+deb9u3
xen Debian:14
- Affected ranges
- ECOSYSTEM: < 4.8.1-1+deb9u3
Update to 4.8.1-1+deb9u3
xen Ubuntu:16.04:LTS
- Versions
- 4.5.1-0ubuntu1
- 4.5.1-0ubuntu2
- 4.6.0-1ubuntu1
- 4.6.0-1ubuntu2
- 4.6.0-1ubuntu4
- 4.6.0-1ubuntu4.1
- 4.6.0-1ubuntu4.2
- 4.6.0-1ubuntu4.3
- 4.6.5-0ubuntu1
- 4.6.5-0ubuntu1.1
- Affected ranges
- ECOSYSTEM: < 4.6.5-0ubuntu1.2
Update to 4.6.5-0ubuntu1.2