kritik
CVE-2017-15597
xen: pin count / page reference race in grant table code (XSA-236)
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.1CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Red Hat6.8CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: Red Hat (orta), Ubuntu (orta).
Açıklama
An issue was discovered in Xen through 4.9.x. Grant copying code made an implication that any grant pin would be accompanied by a suitable page reference. Other portions of code, however, did not match up with that assumption. When such a grant copy operation is being done on a grant of a dying domain, the assumption turns out wrong. A malicious guest administrator can cause hypervisor memory corruption, most likely resulting in host crash and a Denial of Service. Privilege escalation and information leaks cannot be ruled out.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| alpine 3.10 | xen | 4.9.0-r7 |
| alpine 3.11 | xen | 4.9.0-r7 |
| alpine 3.12 | xen | 4.9.0-r7 |
| alpine 3.13 | xen | 4.9.0-r7 |
| alpine 3.14 | xen | 4.9.0-r7 |
| alpine 3.15 | xen | 4.9.0-r7 |
| alpine 3.16 | xen | 4.9.0-r7 |
| alpine 3.17 | xen | 4.9.0-r7 |
| alpine 3.18 | xen | 4.9.0-r7 |
| alpine 3.19 | xen | 4.9.0-r7 |
| alpine 3.20 | xen | 4.9.0-r7 |
| alpine 3.21 | xen | 4.9.0-r7 |
31 kaynaktaki 31 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| alpine 3.10 | xen | 4.9.0-r7 |
| alpine 3.11 | xen | 4.9.0-r7 |
| alpine 3.12 | xen | 4.9.0-r7 |
| alpine 3.13 | xen | 4.9.0-r7 |
| alpine 3.14 | xen | 4.9.0-r7 |
| alpine 3.15 | xen | 4.9.0-r7 |
| alpine 3.16 | xen | 4.9.0-r7 |
| alpine 3.17 | xen | 4.9.0-r7 |
| alpine 3.18 | xen | 4.9.0-r7 |
| alpine 3.19 | xen | 4.9.0-r7 |
| alpine 3.20 | xen | 4.9.0-r7 |
| alpine 3.21 | xen | 4.9.0-r7 |
| alpine 3.22 | xen | 4.9.0-r7 |
| alpine 3.23 | xen | 4.9.0-r7 |
| alpine 3.24 | xen | 4.9.0-r7 |
| alpine 3.4 | xen | 4.6.6-r2 |
| alpine 3.5 | xen | 4.7.3-r3 |
| alpine 3.6 | xen | 4.8.2-r3 |
| alpine 3.7 | xen | 4.9.0-r7 |
| alpine 3.8 | xen | 4.9.0-r7 |
| alpine 3.9 | xen | 4.9.0-r7 |
| alpine edge | xen | 4.9.0-r7 |
| debian 11 | xen | 4.8.2+xsa245-0+deb9u1 |
| debian 12 | xen | 4.8.2+xsa245-0+deb9u1 |
| debian 13 | xen | 4.8.2+xsa245-0+deb9u1 |
| debian 14 | xen | 4.8.2+xsa245-0+deb9u1 |
| debian 8 | xen | 4.4.4lts2-0+deb8u1 |
| debian 9 | xen | 4.8.2+xsa245-0+deb9u1 |
| echo | xen | 4.8.2+xsa245-0+deb9u1 |
| ubuntu 18.04 | xen | 4.9.2-0ubuntu1 |
| ubuntu 18.04-ESM | xen | 4.9.2-0ubuntu1 |
Referanslar
- http://www.openwall.com/lists/oss-security/2017/10/24/3
- http://www.securityfocus.com/bid/101564
- http://www.securitytracker.com/id/1039653
- http://xenbits.xen.org/xsa/advisory-236.html
- https://access.redhat.com/security/cve/CVE-2017-15597
- https://lists.debian.org/debian-lts-announce/2018/10/msg00009.html
- https://nvd.nist.gov/vuln/detail/CVE-2017-15597
- https://support.citrix.com/article/CTX229057