Information disclosure in Xen
CVE-2017-12855
Xen maintains the _GTF_{read,writ}ing bits as appropriate, to inform the guest that a grant is in use. A guest is expected not to modify the grant details while it is in use, whereas the guest is free to modify/reuse the grant entry when it is not in use. Under some circumstances, Xen will clear the status bits too early, incorrectly informing the guest that the grant is no longer in use. A guest may prematurely believe that a granted frame is safely private again, and reuse it in a way which contains sensitive information, while the domain on the far end of the grant is still using the grant. Xen 4.9, 4.8, 4.7, 4.6, and 4.5 are affected.
Vulnerability class: Information Disclosure
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.004 (31.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 31st percentile — 31.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- Xen — versions 4.5.0, 4.5.1, 4.5.2
Weakness classification (CWE)
References
- support.citrix.com/article/CTX225941
- www.securitytracker.com/id/1039177 (VDB Entry, Third Party Advisory, vdb-entry)
- www.securityfocus.com/bid/100341 (VDB Entry, Third Party Advisory, vdb-entry)
- www.debian.org/security/2017/dsa-3969 (vendor-advisory)
- xenbits.xen.org/xsa/advisory-230.html (Vendor Advisory)
Frequently asked questions
- What is CVE-2017-12855?
- CVE-2017-12855 is a medium-severity vulnerability in Xen, classified under Information Disclosure. CVSS score: 6.5/10. Published 2017-08-15.
- How severe is CVE-2017-12855?
- Medium severity. CVSS v3 base score is 6.5 out of 10.