Resource exhaustion in xen (Alpine package)



Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2017-15595
CWE-ID CWE-400
Exploitation vector Local network
Public exploit N/A
Vulnerable software
 xen (Alpine package)
Operating systems & Components / Operating system package or component

Vendor Alpine Linux Development Team

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Resource exhaustion

EUVDB-ID: #VU9452

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-15595

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows an adjacent attacker to gain elevated privileges or cause DoS conditions on the target system.

The weakness exists due to improper input validation. An adjacent attacker can supply specially crafted page-table stacking, trigger unbounded recursion, stack consumption, gain elevated privileges or cause hypervisor crash.

Mitigation

Install update from vendor's website.

Vulnerable software versions

xen (Alpine package): 4.5.0-r0 - 4.6.6-r1

CPE2.3 External links

https://git.alpinelinux.org/aports/commit/?id=0fab8db7500d0c5f6eb28d74ecfc5d9e4fd379e3
https://git.alpinelinux.org/aports/commit/?id=eac7d0a6acaaa7d2ab03a2ce4bfe967a6bba9036
https://git.alpinelinux.org/aports/commit/?id=dc1cbe038e2494f5fa124e3d2942987672acafa6


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###