CVE-2017-14317

published 2017-09-12

CVE-2017-14317: A domain cleanup issue was discovered in the C xenstore daemon (aka cxenstored) in Xen through 4.9.x. When shutting down a VM with a stubdomain, a race in…

Priority P4 19 medium 5.6 CVSS 3.0

AV L AC H PR L UI N S C C N I N A H

A domain cleanup issue was discovered in the C xenstore daemon (aka cxenstored) in Xen through 4.9.x. When shutting down a VM with a stubdomain, a race in cxenstored may cause a double-free. The xenstored daemon may crash, resulting in a DoS of any parts of the system relying on it (including domain creation / destruction, ballooning, device changes, etc.).

Affected

6 ranges

Vendor	Product	Version range	Fixed in
debian	xen	< xen 4.8.2+xsa245-0+deb9u1 (bookworm)	xen 4.8.2+xsa245-0+deb9u1 (bookworm)
xen	xen	<= 4.9.0	—
xen	xen	>= 0 < 4.8.2+xsa245-0+deb9u1	4.8.2+xsa245-0+deb9u1
xen	xen	>= 0 < 4.8.2+xsa245-0+deb9u1	4.8.2+xsa245-0+deb9u1
xen	xen	>= 0 < 4.8.2+xsa245-0+deb9u1	4.8.2+xsa245-0+deb9u1
xen	xen	>= 0 < 4.8.2+xsa245-0+deb9u1	4.8.2+xsa245-0+deb9u1

CVSS provenance

nvd v3.0 5.6 MEDIUM CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H

nvd v2.0 4.7 MEDIUM AV:L/AC:M/Au:N/C:N/I:N/A:C

osv 5.6 MEDIUM

vendor_debian 5.6 MEDIUM

vendor_redhat 5.6 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-362