CVE-2017-15589

MEDIUM

Xen through 4.9.x - Unauthenticated Exposure of Sensitive Information via Intercepted I/O Operations

Title source: llm

Description

An issue was discovered in Xen through 4.9.x allowing x86 HVM guest OS users to obtain sensitive information from the host OS (or an arbitrary guest OS) because intercepted I/O operations can cause a write of data from uninitialized hypervisor stack memory.

References (8)

Core 8

Core References

Mailing List mailing-list x_refsource_mlist

https://lists.debian.org/debian-lts-announce/2017/11/msg00027.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/101496

Mailing List, Mitigation, Patch, Vendor Advisory x_refsource_confirm

https://xenbits.xen.org/xsa/advisory-239.html

Third Party Advisory vendor-advisory x_refsource_debian

https://www.debian.org/security/2017/dsa-4050

Vendor Advisory x_refsource_confirm

https://support.citrix.com/article/CTX228867

Mailing List mailing-list x_refsource_mlist

https://lists.debian.org/debian-lts-announce/2018/10/msg00009.html

Third Party Advisory vendor-advisory x_refsource_gentoo

https://security.gentoo.org/glsa/201801-14

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1039568

Scores

CVSS v3 6.5

EPSS 0.0009

EPSS Percentile 26.0%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Details

CWE

CWE-200

Status published

Products (1)

xen/xen 4.9.0

Published Oct 18, 2017

Tracked Since Feb 18, 2026