CVE-2017-15597

Description

An issue was discovered in Xen through 4.9.x. Grant copying code made an implication that any grant pin would be accompanied by a suitable page reference. Other portions of code, however, did not match up with that assumption. When such a grant copy operation is being done on a grant of a dying domain, the assumption turns out wrong. A malicious guest administrator can cause hypervisor memory corruption, most likely resulting in host crash and a Denial of Service. Privilege escalation and information leaks cannot be ruled out.

Weakness classification

• CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Primary references

• cve@mitre.org — Issue Tracking, Mailing List, Mitigation, Third Party Advisory
• cve@mitre.org — Issue Tracking, Third Party Advisory, VDB Entry
• cve@mitre.org — Issue Tracking, Third Party Advisory, VDB Entry
• cve@mitre.org — Issue Tracking, Patch, Vendor Advisory
• cve@mitre.org
• cve@mitre.org — Issue Tracking, Third Party Advisory
• cve@mitre.org
• af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Mailing List, Mitigation, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Third Party Advisory, VDB Entry
• af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Third Party Advisory, VDB Entry
• af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Patch, Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108