CVE-2017-14431

MEDIUM

Xen 3.3-4.8.x - Denial of Service via Memory Leak in Guest Reboot Handling

Title source: llm

Description

Memory leak in Xen 3.3 through 4.8.x allows guest OS users to cause a denial of service (ARM or x86 AMD host OS memory consumption) by continually rebooting, because certain cleanup is skipped if no pass-through device was ever assigned, aka XSA-207.

References (2)

Core 2

Core References

Mailing List mailing-list x_refsource_mlist

https://lists.debian.org/debian-lts-announce/2018/09/msg00006.html

Mitigation, Patch, Vendor Advisory x_refsource_confirm

https://xenbits.xen.org/xsa/advisory-207.html

Scores

CVSS v3 5.5

EPSS 0.0013

EPSS Percentile 31.5%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Details

CWE

CWE-772

Status published

Products (49)

xen/xen 3.3.0

xen/xen 3.3.1

xen/xen 3.3.2

xen/xen 3.4.0

xen/xen 3.4.1

xen/xen 3.4.2

xen/xen 3.4.3

xen/xen 3.4.4

xen/xen 4.0.0

xen/xen 4.0.1

... and 39 more

Published Sep 13, 2017

Tracked Since Feb 18, 2026