CVE-2017-17045
Fixed in a distro release EPSS <1%
An issue was discovered in Xen through 4.9.x allowing HVM guest OS users to gain privileges on the host OS, obtain sensitive information, or cause a denial of service (BUG and host OS crash) by leveraging the mishandling of Populate on Demand (PoD) Physical-to-Machine (P2M) errors.
Products: xen
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.5 | xen | 4.7.3-r2 |
| Alpine 3.6 | xen | 4.8.2-r2 |
| Debian 12 | xen | 4.8.2+xsa245-0+deb9u1 |
| Debian 13 | xen | 4.8.2+xsa245-0+deb9u1 |
| Debian 14 | xen | 4.8.2+xsa245-0+deb9u1 |
| Debian 7 | xen | 4.1.6.lts1-11 |
| Debian 8 | xen | 4.4.4lts3-0+deb8u1 |
| Debian 9 | xen | 4.8.2+xsa245-0+deb9u1 |
| Ubuntu 16.04 LTS | xen | no fix |
| Ubuntu 18.04 LTS | xen | 4.9.2-0ubuntu1 |