CVE-2017-10923

MEDIUM

Xen - Improper Input Validation

Title source: rule

Description

Xen through 4.8.x does not validate a vCPU array index upon the sending of an SGI, which allows guest OS users to cause a denial of service (hypervisor crash), aka XSA-225.

References (4)

[Tool Signature, VDB Entry] http://www.securityfocus.com/bid/99160

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id/1038735

[Mailing List, Mitigation, Vendor Advisory] https://xenbits.xen.org/xsa/advisory-225.html

[Third Party Advisory] https://security.gentoo.org/glsa/201708-03

Scores

CVSS v3 6.5

EPSS 0.0078

EPSS Percentile 73.5%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Details

CWE

CWE-20

Status published

Products (9)

xen/xen

n/a/n/a

Published Jul 05, 2017

Tracked Since Feb 18, 2026