CVSS: 5.6EPSS: 0%CPEs: 1EXPL: 0CVE-2017-17565
https://notcve.org/view.php?id=CVE-2017-17565
An issue was discovered in Xen through 4.9.x allowing PV guest OS users to cause a denial of service (host OS crash) if shadow mode and log-dirty mode are in place, because of an incorrect assertion related to M2P. Se ha descubierto un problema en Xen, hasta las versiones 4.9.x, que permite que los usuarios PV invitados del sistema operativo provoquen una denegación de servicio (cierre inesperado del host del sistema operativo) si se han establecido los modos shadow y log-dirty. Esto se debe a una aserción incorrecta relacionada con M2P. • http://www.openwall.com/lists/oss-security/2017/12/12/5 http://www.securityfocus.com/bid/102175 http://www.securitytracker.com/id/1040771 https://lists.debian.org/debian-lts-announce/2018/01/msg00003.html https://lists.debian.org/debian-lts-announce/2018/10/msg00009.html https://security.gentoo.org/glsa/201801-14 https://support.citrix.com/article/CTX232096 https://www.debian.org/security/2018/dsa-4112 https://xenbits.xen.org/xsa/advisory-251.html • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-17566
https://notcve.org/view.php?id=CVE-2017-17566
An issue was discovered in Xen through 4.9.x allowing PV guest OS users to cause a denial of service (host OS crash) or gain host OS privileges in shadow mode by mapping a certain auxiliary page. Se ha descubierto un problema en Xen hasta las versiones 4.9.x que permite que usuarios PV invitados del sistema operativo provoquen una denegación de servicio (cierre inesperado del host del sistema operativo) u obtengan privilegios del host del sistema operativo en modo shadow asignando cierta página auxiliar. • http://www.openwall.com/lists/oss-security/2017/12/12/4 http://www.securityfocus.com/bid/102167 http://www.securitytracker.com/id/1040768 https://lists.debian.org/debian-lts-announce/2018/01/msg00003.html https://lists.debian.org/debian-lts-announce/2018/10/msg00009.html https://security.gentoo.org/glsa/201801-14 https://support.citrix.com/article/CTX232096 https://www.debian.org/security/2018/dsa-4112 https://xenbits.xen.org/xsa/advisory-248.html •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-17044
https://notcve.org/view.php?id=CVE-2017-17044
An issue was discovered in Xen through 4.9.x allowing HVM guest OS users to cause a denial of service (infinite loop and host OS hang) by leveraging the mishandling of Populate on Demand (PoD) errors. Se ha descubierto un problema en Xen hasta la versión 4.9.x que permite que los usuarios invitados HVM del sistema operativo provoquen una denegación de servicio (bucle infinito y bloqueo del host del sistema operativo) aprovechando la gestión incorrecta de errores PoD (Populate on Demand). • http://www.securityfocus.com/bid/102008 http://www.securityfocus.com/bid/102129 http://www.securityfocus.com/bid/105954 http://www.securitytracker.com/id/1039878 https://lists.debian.org/debian-lts-announce/2018/01/msg00003.html https://lists.debian.org/debian-lts-announce/2018/10/msg00021.html https://security.gentoo.org/glsa/201801-14 https://support.citrix.com/article/CTX230138 https://xenbits.xen.org/xsa/advisory-246.html • CWE-754: Improper Check for Unusual or Exceptional Conditions CWE-755: Improper Handling of Exceptional Conditions CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-17045
https://notcve.org/view.php?id=CVE-2017-17045
An issue was discovered in Xen through 4.9.x allowing HVM guest OS users to gain privileges on the host OS, obtain sensitive information, or cause a denial of service (BUG and host OS crash) by leveraging the mishandling of Populate on Demand (PoD) Physical-to-Machine (P2M) errors. Se ha descubierto un problema en Xen hasta la versión 4.9.x que permite que los usuarios invitados HVM del sistema operativo obtengan privilegios en el host del sistema operativo, obtengan información sensible o provoquen una denegación de servicio (error y cierre inesperado del host del sistema operativo) aprovechando la gestión incorrecta de errores PoD (Populate on Demand) P2M (Physical-to-Machine). • http://www.securityfocus.com/bid/102013 http://www.securityfocus.com/bid/102129 http://www.securitytracker.com/id/1039879 https://lists.debian.org/debian-lts-announce/2018/01/msg00003.html https://lists.debian.org/debian-lts-announce/2018/10/msg00021.html https://security.gentoo.org/glsa/201801-14 https://support.citrix.com/article/CTX230138 https://xenbits.xen.org/xsa/advisory-247.html • CWE-416: Use After Free •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-17046
https://notcve.org/view.php?id=CVE-2017-17046
An issue was discovered in Xen through 4.9.x on the ARM platform allowing guest OS users to obtain sensitive information from DRAM after a reboot, because disjoint blocks, and physical addresses that do not start at zero, are mishandled. Se ha descubierto un problema en Xen hasta la versión 4.9.x en la plataforma ARM que permite que usuarios invitados del sistema operativo obtengan información sensible del DRAM tras un reinicio, ya que se gestionan de manera incorrecta los bloques no contiguos y las direcciones físicas que no empiezan en cero. • https://lists.debian.org/debian-lts-announce/2018/10/msg00009.html https://security.gentoo.org/glsa/201801-14 https://xenbits.xen.org/xsa/advisory-245.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •