CVE-2017-15589 — Sensitive Information Exposure in XEN

CWE-200 — Sensitive Information Exposure7 documents6 sources
Severity
6.5MEDIUMNVD
EPSS
0.1%
top 73.92%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
XENDebian XEN
Timeline
PublishedOct 18
Latest updateMay 14

Description

An issue was discovered in Xen through 4.9.x allowing x86 HVM guest OS users to obtain sensitive information from the host OS (or an arbitrary guest OS) because intercepted I/O operations can cause a write of data from uninitialized hypervisor stack memory.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:NExploitability: 2.0 | Impact: 4.0

Affected Packages3 packages

▶debiandebian/xen< xen 4.8.2+xsa245-0+deb9u1 (bookworm)
▶Debianxen/xen< 4.8.2+xsa245-0+deb9u1+3
▶NVDxen/xen4.9.0

Patches

Patch: xenbits.xen.org ↗Patch: xenbits.xen.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-cjqp-w58x-g83v: An issue was discovered in Xen through 4↗2022-05-14
▶
OSV
CVE-2017-15589: An issue was discovered in Xen through 4↗2017-10-18
▶

📋Vendor Advisories

2
Red Hat
xen: hypervisor stack leak in x86 I/O intercept code (XSA-239)↗2017-10-12
▶
Debian
CVE-2017-15589: xen - An issue was discovered in Xen through 4.9.x allowing x86 HVM guest OS users to ...↗2017
▶

💬Community

2
Bugzilla
CVE-2017-15588 CVE-2017-15589 CVE-2017-15590 CVE-2017-15591 CVE-2017-15592 CVE-2017-15593 CVE-2017-15594 CVE-2017-15595 xen: various flaws [fedora-all]↗2017-10-12
▶
Bugzilla
CVE-2017-15589 xsa239 xen: hypervisor stack leak in x86 I/O intercept code (XSA-239)↗2017-10-09
▶