Buffer overflow in Xen

CVE-2017-15597

An issue was discovered in Xen through 4.9.x. Grant copying code made an implication that any grant pin would be accompanied by a suitable page reference. Other portions of code, however, did not match up with that assumption. When such a grant copy operation is being done on a grant of a dying domain, the assumption turns out wrong. A malicious guest administrator can cause hypervisor memory corruption, most likely resulting in host crash and a Denial of Service. Privilege escalation and information leaks cannot be ruled out.

Vulnerability class: Buffer Overflow

EPSS: 0.028 (85.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.

Affected products

  • Xen
  • N/a — versions n/a

Weakness classification (CWE)

References

  • cve@mitre.org (x_refsource_CONFIRM, Patch, Issue Tracking, Vendor Advisory)
  • cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, Issue Tracking, x_refsource_BID)
  • cve@mitre.org (mailing-list, x_refsource_MLIST, Mailing List, Third Party Advisory, Mitigation, Issue Tracking)
  • cve@mitre.org (vendor-advisory, x_refsource_DEBIAN)
  • cve@mitre.org (x_refsource_CONFIRM, Third Party Advisory, Issue Tracking)
  • cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, Issue Tracking, x_refsource_SECTRACK)
  • cve@mitre.org (mailing-list, x_refsource_MLIST)

Frequently asked questions

What is CVE-2017-15597?
CVE-2017-15597 is a critical-severity vulnerability in Xen, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 9.1/10. Published 2017-10-30.
How severe is CVE-2017-15597?
Critical severity. CVSS v3 base score is 9.1 out of 10.