CVE-2017-10916
Fixed in a distro release EPSS 1%
The vCPU context-switch implementation in Xen through 4.8.x improperly interacts with the Memory Protection Extensions (MPX) and Protection Key (PKU) features, which makes it easier for guest OS users to defeat ASLR and other protection mechanisms, aka XSA-220.
Products: xen
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.10 | xen | 4.9.0-r0 |
| Alpine 3.11 | xen | 4.9.0-r0 |
| Alpine 3.12 | xen | 4.9.0-r0 |
| Alpine 3.13 | xen | 4.9.0-r0 |
| Alpine 3.14 | xen | 4.9.0-r0 |
| Alpine 3.15 | xen | 4.9.0-r0 |
| Alpine 3.16 | xen | 4.9.0-r0 |
| Alpine 3.17 | xen | 4.9.0-r0 |
| Alpine 3.18 | xen | 4.9.0-r0 |
| Alpine 3.19 | xen | 4.9.0-r0 |
| Alpine 3.20 | xen | 4.9.0-r0 |
| Alpine 3.21 | xen | 4.9.0-r0 |
| Alpine 3.22 | xen | 4.9.0-r0 |
| Alpine 3.23 | xen | 4.9.0-r0 |
| Alpine 3.24 | xen | 4.9.0-r0 |
| Alpine 3.3 | xen | 4.6.6-r0 |
| Alpine 3.4 | xen | 4.6.6-r0 |
| Alpine 3.5 | xen | 4.7.3-r0 |
| Alpine 3.6 | xen | 4.8.2-r0 |
| Alpine 3.7 | xen | 4.9.0-r0 |
| Alpine 3.8 | xen | 4.9.0-r0 |
| Alpine 3.9 | xen | 4.9.0-r0 |
| Debian 12 | xen | 4.8.1-1+deb9u3 |
| Debian 13 | xen | 4.8.1-1+deb9u3 |
| Debian 14 | xen | 4.8.1-1+deb9u3 |
| SUSE Linux Enterprise Server 12 SP1-LTSS | xen | 4.5.5_12-22.18.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | xen | 4.5.5_12-22.18.1 |
| SUSE OpenStack Cloud 6 | xen | 4.5.5_12-22.18.1 |
| Ubuntu 16.04 LTS | xen | 4.6.5-0ubuntu1.2 |