kritisch
CVE-2017-10917
xen: NULL pointer deref in event channel poll (XSA-221)
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.1CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Red Hat8.5CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut Red Hat (hoch), Ubuntu (mittel).
Beschreibung
Xen through 4.8.x does not validate the port numbers of polled event channel ports, which allows guest OS users to cause a denial of service (NULL pointer dereference and host OS crash) or possibly obtain sensitive information, aka XSA-221.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| alpine 3.10 | xen | 4.9.0-r0 |
| alpine 3.11 | xen | 4.9.0-r0 |
| alpine 3.12 | xen | 4.9.0-r0 |
| alpine 3.13 | xen | 4.9.0-r0 |
| alpine 3.14 | xen | 4.9.0-r0 |
| alpine 3.15 | xen | 4.9.0-r0 |
| alpine 3.16 | xen | 4.9.0-r0 |
| alpine 3.17 | xen | 4.9.0-r0 |
| alpine 3.18 | xen | 4.9.0-r0 |
| alpine 3.19 | xen | 4.9.0-r0 |
| alpine 3.20 | xen | 4.9.0-r0 |
| alpine 3.21 | xen | 4.9.0-r0 |
Alle 35 Einträge aus 35 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| alpine 3.10 | xen | 4.9.0-r0 |
| alpine 3.11 | xen | 4.9.0-r0 |
| alpine 3.12 | xen | 4.9.0-r0 |
| alpine 3.13 | xen | 4.9.0-r0 |
| alpine 3.14 | xen | 4.9.0-r0 |
| alpine 3.15 | xen | 4.9.0-r0 |
| alpine 3.16 | xen | 4.9.0-r0 |
| alpine 3.17 | xen | 4.9.0-r0 |
| alpine 3.18 | xen | 4.9.0-r0 |
| alpine 3.19 | xen | 4.9.0-r0 |
| alpine 3.20 | xen | 4.9.0-r0 |
| alpine 3.21 | xen | 4.9.0-r0 |
| alpine 3.22 | xen | 4.9.0-r0 |
| alpine 3.23 | xen | 4.9.0-r0 |
| alpine 3.24 | xen | 4.9.0-r0 |
| alpine 3.3 | xen | 4.6.6-r0 |
| alpine 3.4 | xen | 4.6.6-r0 |
| alpine 3.5 | xen | 4.7.3-r0 |
| alpine 3.6 | xen | 4.8.2-r0 |
| alpine 3.7 | xen | 4.9.0-r0 |
| alpine 3.8 | xen | 4.9.0-r0 |
| alpine 3.9 | xen | 4.9.0-r0 |
| alpine edge | xen | 4.9.0-r0 |
| debian 11 | xen | 4.8.1-1+deb9u3 |
| debian 12 | xen | 4.8.1-1+deb9u3 |
| debian 13 | xen | 4.8.1-1+deb9u3 |
| debian 14 | xen | 4.8.1-1+deb9u3 |
| debian 8 | xen | 4.4.1-9+deb8u10 |
| debian 9 | xen | 4.8.1-1+deb9u3 |
| echo | xen | 4.8.1-1+deb9u3 |
| ubuntu 14.04 | xen | 4.4.2-0ubuntu0.14.04.12 |
| ubuntu 16.04 | xen | 4.6.5-0ubuntu1.2 |
| ubuntu 16.04-ESM | xen | 4.6.5-0ubuntu1.2 |
| ubuntu 16.10 | xen | 4.7.2-0ubuntu1.3 |
| ubuntu 17.04 | xen | 4.8.0-1ubuntu2.2 |
Referenzen
- http://www.debian.org/security/2017/dsa-3969
- http://www.securityfocus.com/bid/99157
- http://www.securitytracker.com/id/1038731
- http://xenbits.xen.org/xsa/advisory-221.html
- https://access.redhat.com/security/cve/CVE-2017-10917
- https://nvd.nist.gov/vuln/detail/CVE-2017-10917
- https://security.gentoo.org/glsa/201708-03
- https://www.cve.org/CVERecord?id=CVE-2017-10917