CVE-2017-14431
published 2017-09-13CVE-2017-14431: Memory leak in Xen 3.3 through 4.8.x allows guest OS users to cause a denial of service (ARM or x86 AMD host OS memory consumption) by continually rebooting…
PriorityP418medium5.5CVSS 3.0
AVLACLPRLUINSUCNINAH
EPSS
0.34%
26.3th percentile
Memory leak in Xen 3.3 through 4.8.x allows guest OS users to cause a denial of service (ARM or x86 AMD host OS memory consumption) by continually rebooting, because certain cleanup is skipped if no pass-through device was ever assigned, aka XSA-207.
Affected
55 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | xen | < xen 4.8.1-1 (bookworm) | xen 4.8.1-1 (bookworm) |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
CVSS provenance
nvdv3.05.5MEDIUMCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv2.04.9MEDIUMAV:L/AC:L/Au:N/C:N/I:N/A:C
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-5c92-xf29-3c94: Memory leak in Xen 3
ghsa_unreviewed·2022-05-13
CVE-2017-14431 [MEDIUM] CWE-772 GHSA-5c92-xf29-3c94: Memory leak in Xen 3
Memory leak in Xen 3.3 through 4.8.x allows guest OS users to cause a denial of service (ARM or x86 AMD host OS memory consumption) by continually rebooting, because certain cleanup is skipped if no pass-through device was ever assigned, aka XSA-207.
OSV
CVE-2017-14431: Memory leak in Xen 3
osv·2017-09-13·CVSS 5.5
CVE-2017-14431 [MEDIUM] CVE-2017-14431: Memory leak in Xen 3
Memory leak in Xen 3.3 through 4.8.x allows guest OS users to cause a denial of service (ARM or x86 AMD host OS memory consumption) by continually rebooting, because certain cleanup is skipped if no pass-through device was ever assigned, aka XSA-207.
Red Hat
xen: memory leak when destroying guest without PT devices (XSA-207)
vendor_redhat·2017-02-15·CVSS 5.5
CVE-2017-14431 [MEDIUM] xen: memory leak when destroying guest without PT devices (XSA-207)
xen: memory leak when destroying guest without PT devices (XSA-207)
Memory leak in Xen 3.3 through 4.8.x allows guest OS users to cause a denial of service (ARM or x86 AMD host OS memory consumption) by continually rebooting, because certain cleanup is skipped if no pass-through device was ever assigned, aka XSA-207.
Package: xen (Red Hat Enterprise Linux 5) - Will not fix
Debian
CVE-2017-14431: xen - Memory leak in Xen 3.3 through 4.8.x allows guest OS users to cause a denial of ...
vendor_debian·2017·CVSS 5.5
CVE-2017-14431 [MEDIUM] CVE-2017-14431: xen - Memory leak in Xen 3.3 through 4.8.x allows guest OS users to cause a denial of ...
Memory leak in Xen 3.3 through 4.8.x allows guest OS users to cause a denial of service (ARM or x86 AMD host OS memory consumption) by continually rebooting, because certain cleanup is skipped if no pass-through device was ever assigned, aka XSA-207.
Scope: local
bookworm: resolved (fixed in 4.8.1-1)
bullseye: resolved (fixed in 4.8.1-1)
forky: resolved (fixed in 4.8.1-1)
sid: resolved (fixed in 4.8.1-1)
trixie: resolved (fixed in 4.8.1-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2017-14431 xsa207 xen: memory leak when destroying guest without PT devices (XSA-207) [fedora-all]
bugzilla·2017-02-15·CVSS 5.5
CVE-2017-14431 [MEDIUM] CVE-2017-14431 xsa207 xen: memory leak when destroying guest without PT devices (XSA-207) [fedora-all]
CVE-2017-14431 xsa207 xen: memory leak when destroying guest without PT devices (XSA-207) [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multip
Bugzilla
CVE-2017-14431 xsa207 xen: memory leak when destroying guest without PT devices (XSA-207)
bugzilla·2017-02-01·CVSS 5.5
CVE-2017-14431 [MEDIUM] CVE-2017-14431 xsa207 xen: memory leak when destroying guest without PT devices (XSA-207)
CVE-2017-14431 xsa207 xen: memory leak when destroying guest without PT devices (XSA-207)
ISSUE DESCRIPTION
Certain internal state is set up, during domain construction, in
preparation for possible pass-through device assignment. On ARM and
AMD V-i hardware this setup includes memory allocation. On guest
teardown, cleanup was erroneously only performed when the guest
actually had a pass-through device assigned.
IMPACT
A malicious guest may, by frequently rebooting over extended periods
of time, run the system out of memory, resulting in a Denial of
Service (DoS).
The leak is no more than 4kbytes per guest boot.
VULNERABLE SYSTEMS
Xen versions 3.3 and later are affected.
ARM systems, and x86 AMD systems, are affected. Intel systems, and
systems without IOMMU/SMMU hardware, are unaff
2017-09-13
Published