CVE-2017-17046 — Sensitive Information Exposure in XEN

CWE-200 — Sensitive Information Exposure7 documents6 sources
Severity
6.5MEDIUMNVD
EPSS
0.1%
top 82.31%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
XENDebian XEN
Timeline
PublishedNov 28
Latest updateMay 14

Description

An issue was discovered in Xen through 4.9.x on the ARM platform allowing guest OS users to obtain sensitive information from DRAM after a reboot, because disjoint blocks, and physical addresses that do not start at zero, are mishandled.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:NExploitability: 2.0 | Impact: 4.0

Affected Packages3 packages

▶debiandebian/xen< xen 4.8.2+xsa245-0+deb9u1 (bookworm)
▶Debianxen/xen< 4.8.2+xsa245-0+deb9u1+3
▶NVDxen/xen4.9.1

Patches

Patch: xenbits.xen.org ↗Patch: xenbits.xen.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-77j8-57q3-5v26: An issue was discovered in Xen through 4↗2022-05-14
▶
OSV
CVE-2017-17046: An issue was discovered in Xen through 4↗2017-11-28
▶

📋Vendor Advisories

2
Red Hat
xen: ARM: Some memory not scrubbed at boot (XSA-245)↗2017-09-28
▶
Debian
CVE-2017-17046: xen - An issue was discovered in Xen through 4.9.x on the ARM platform allowing guest ...↗2017
▶

💬Community

2
Bugzilla
CVE-2017-17046 xsa245 xen: ARM: Some memory not scrubbed at boot (XSA-245) [fedora-all]↗2017-10-09
▶
Bugzilla
CVE-2017-17046 xsa245 xen: ARM: Some memory not scrubbed at boot (XSA-245)↗2017-10-09
▶