CVE-2017-10912
critical
CVSS v3
10.0
CVSS v2
10.0
VIR risk
10.0
Description
Xen through 4.8.x mishandles page transfer, which allows guest OS users to obtain privileged host OS access, aka XSA-217.
Predictions
Exploit likelihood
98%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2017-10912
Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2017-10912.html
Vendor advisory: cve@mitre.org — https://xenbits.xen.org/xsa/advisory-217.html
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| sles | affected | | |
| debian | bookworm | fixed | 4.8.1-1+deb9u3 |
| debian | bullseye | fixed | 4.8.1-1+deb9u3 |
| debian | forky | fixed | 4.8.1-1+deb9u3 |
| debian | sid | fixed | 4.8.1-1+deb9u3 |
| debian | trixie | fixed | 4.8.1-1+deb9u3 |
References
- http://www.debian.org/security/2017/dsa-3969
- http://www.securityfocus.com/bid/99158
- http://www.securitytracker.com/id/1038721
- https://security.gentoo.org/glsa/201708-03
- https://security.gentoo.org/glsa/201710-17
- https://xenbits.xen.org/xsa/advisory-217.html
- https://www.suse.com/security/cve/CVE-2017-10912.html
- https://security-tracker.debian.org/tracker/CVE-2017-10912
Verify integrity in audit chain (admin only). AS-IS.