CVE-2017-17045
CVE-2017-17045
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An issue was discovered in Xen through 4.9.x allowing HVM guest OS users to gain privileges on the host OS, obtain sensitive information, or cause a denial of service (BUG and host OS crash) by leveraging the mishandling of Populate on Demand (PoD) Physical-to-Machine (P2M) errors.
CVSS 8.8 · High · EPSS 0.4% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
xen Debian:12
- Affected ranges
- ECOSYSTEM: < 4.8.2+xsa245-0+deb9u1
Update to 4.8.2+xsa245-0+deb9u1
xen Debian:13
- Affected ranges
- ECOSYSTEM: < 4.8.2+xsa245-0+deb9u1
Update to 4.8.2+xsa245-0+deb9u1
xen Debian:14
- Affected ranges
- ECOSYSTEM: < 4.8.2+xsa245-0+deb9u1
Update to 4.8.2+xsa245-0+deb9u1
xen Ubuntu:16.04:LTS
- Versions
- 4.5.1-0ubuntu1
- 4.5.1-0ubuntu2
- 4.6.0-1ubuntu1
- 4.6.0-1ubuntu2
- 4.6.0-1ubuntu4
- 4.6.0-1ubuntu4.1
- 4.6.0-1ubuntu4.2
- 4.6.0-1ubuntu4.3
- 4.6.5-0ubuntu1
- 4.6.5-0ubuntu1.1
- 4.6.5-0ubuntu1.2
- 4.6.5-0ubuntu1.4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
xen Ubuntu:18.04:LTS
- Versions
- 4.9.0-0ubuntu3
- 4.9.0-0ubuntu4
- Affected ranges
- ECOSYSTEM: < 4.9.2-0ubuntu1
Update to 4.9.2-0ubuntu1
Original sources
- http://www.securityfocus.com/bid/102013
- https://lists.debian.org/debian-lts-announce/2018/10/msg00021.html
- http://www.securitytracker.com/id/1039879
- http://www.securityfocus.com/bid/102129
- https://lists.debian.org/debian-lts-announce/2018/01/msg00003.html
- https://xenbits.xen.org/xsa/advisory-247.html
- https://security.gentoo.org/glsa/201801-14
- https://support.citrix.com/article/CTX230138
- https://nvd.nist.gov/vuln/detail/CVE-2017-17045