CVE-2017-10917
xen: NULL pointer deref in event channel poll (XSA-221)
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Red Hat (alta), Ubuntu (media).
Descripción
Xen through 4.8.x does not validate the port numbers of polled event channel ports, which allows guest OS users to cause a denial of service (NULL pointer dereference and host OS crash) or possibly obtain sensitive information, aka XSA-221.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| alpine 3.10 | xen | 4.9.0-r0 |
| alpine 3.11 | xen | 4.9.0-r0 |
| alpine 3.12 | xen | 4.9.0-r0 |
| alpine 3.13 | xen | 4.9.0-r0 |
| alpine 3.14 | xen | 4.9.0-r0 |
| alpine 3.15 | xen | 4.9.0-r0 |
| alpine 3.16 | xen | 4.9.0-r0 |
| alpine 3.17 | xen | 4.9.0-r0 |
| alpine 3.18 | xen | 4.9.0-r0 |
| alpine 3.19 | xen | 4.9.0-r0 |
| alpine 3.20 | xen | 4.9.0-r0 |
| alpine 3.21 | xen | 4.9.0-r0 |
Mostrar las 35 entradas de 35 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| alpine 3.10 | xen | 4.9.0-r0 |
| alpine 3.11 | xen | 4.9.0-r0 |
| alpine 3.12 | xen | 4.9.0-r0 |
| alpine 3.13 | xen | 4.9.0-r0 |
| alpine 3.14 | xen | 4.9.0-r0 |
| alpine 3.15 | xen | 4.9.0-r0 |
| alpine 3.16 | xen | 4.9.0-r0 |
| alpine 3.17 | xen | 4.9.0-r0 |
| alpine 3.18 | xen | 4.9.0-r0 |
| alpine 3.19 | xen | 4.9.0-r0 |
| alpine 3.20 | xen | 4.9.0-r0 |
| alpine 3.21 | xen | 4.9.0-r0 |
| alpine 3.22 | xen | 4.9.0-r0 |
| alpine 3.23 | xen | 4.9.0-r0 |
| alpine 3.24 | xen | 4.9.0-r0 |
| alpine 3.3 | xen | 4.6.6-r0 |
| alpine 3.4 | xen | 4.6.6-r0 |
| alpine 3.5 | xen | 4.7.3-r0 |
| alpine 3.6 | xen | 4.8.2-r0 |
| alpine 3.7 | xen | 4.9.0-r0 |
| alpine 3.8 | xen | 4.9.0-r0 |
| alpine 3.9 | xen | 4.9.0-r0 |
| alpine edge | xen | 4.9.0-r0 |
| debian 11 | xen | 4.8.1-1+deb9u3 |
| debian 12 | xen | 4.8.1-1+deb9u3 |
| debian 13 | xen | 4.8.1-1+deb9u3 |
| debian 14 | xen | 4.8.1-1+deb9u3 |
| debian 8 | xen | 4.4.1-9+deb8u10 |
| debian 9 | xen | 4.8.1-1+deb9u3 |
| echo | xen | 4.8.1-1+deb9u3 |
| ubuntu 14.04 | xen | 4.4.2-0ubuntu0.14.04.12 |
| ubuntu 16.04 | xen | 4.6.5-0ubuntu1.2 |
| ubuntu 16.04-ESM | xen | 4.6.5-0ubuntu1.2 |
| ubuntu 16.10 | xen | 4.7.2-0ubuntu1.3 |
| ubuntu 17.04 | xen | 4.8.0-1ubuntu2.2 |
Referencias
- http://www.debian.org/security/2017/dsa-3969
- http://www.securityfocus.com/bid/99157
- http://www.securitytracker.com/id/1038731
- http://xenbits.xen.org/xsa/advisory-221.html
- https://access.redhat.com/security/cve/CVE-2017-10917
- https://nvd.nist.gov/vuln/detail/CVE-2017-10917
- https://security.gentoo.org/glsa/201708-03
- https://www.cve.org/CVERecord?id=CVE-2017-10917