CVE-2017-7995
 
Severity Score
3.8
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Xen PV guest before Xen 4.3 checked access permissions to MMIO ranges only after accessing them, allowing host PCI device space memory reads, leading to information disclosure. This is an error in the get_user function. NOTE: the upstream Xen Project considers versions before 4.5.x to be EOL.
Xen PV guest anterior a Xen 4.3 chequea los permisos de acceso a los rangos MMIO sólo después de acceder a ellos, lo que permite leer en un dispositivo de memoria PCI, dando lugar a la divulgación de información. Se trata de un error en la función get_user. NOTA: el upstream Xen Project considera versiones anteriores a 4.5.x para ser EOL.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2017-04-21 CVE Reserved
- 2017-05-03 CVE Published
- 2023-03-08 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CAPEC
References (3)
URL | Tag | Source |
---|---|---|
http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00005.html | Third Party Advisory | |
http://www.securityfocus.com/bid/98314 | Third Party Advisory | |
https://bugzilla.suse.com/show_bug.cgi?id=1033948 | Issue Tracking |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Xen Search vendor "Xen" | Xen Search vendor "Xen" for product "Xen" | <= 4.2.5 Search vendor "Xen" for product "Xen" and version " <= 4.2.5" | - |
Affected
| ||||||
Suse Search vendor "Suse" | Manager Search vendor "Suse" for product "Manager" | 2.1 Search vendor "Suse" for product "Manager" and version "2.1" | - |
Affected
| ||||||
Suse Search vendor "Suse" | Manager Proxy Search vendor "Suse" for product "Manager Proxy" | 2.1 Search vendor "Suse" for product "Manager Proxy" and version "2.1" | - |
Affected
| ||||||
Suse Search vendor "Suse" | Openstack Cloud Search vendor "Suse" for product "Openstack Cloud" | 5 Search vendor "Suse" for product "Openstack Cloud" and version "5" | - |
Affected
| ||||||
Novell Search vendor "Novell" | Suse Linux Enterprise Point Of Sale Search vendor "Novell" for product "Suse Linux Enterprise Point Of Sale" | 11.0 Search vendor "Novell" for product "Suse Linux Enterprise Point Of Sale" and version "11.0" | sp3 |
Affected
| ||||||
Novell Search vendor "Novell" | Suse Linux Enterprise Server Search vendor "Novell" for product "Suse Linux Enterprise Server" | 11.0 Search vendor "Novell" for product "Suse Linux Enterprise Server" and version "11.0" | sp3, ltss |
Affected
|