Information disclosure in xen (Alpine package)



Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2017-17046
CWE-ID CWE-200
Exploitation vector Local network
Public exploit N/A
Vulnerable software
Subscribe 		xen (Alpine package)
Operating systems & Components / Operating system package or component

Vendor Alpine Linux Development Team

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Information disclosure

EUVDB-ID: #VU8671

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-17046

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows an adjacent attacker to obtain potentially sensitive information.

The weakness exists in ARM systems due to the improper scrubbing of DRAM content during reboots when memory is in disjoint blocks or when the first block isn't at physical address 0. An adjacent attacker gain access to arbitrary data on the target system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

xen (Alpine package): 4.5.0-r0 - 4.6.6-r1

CPE2.3 External links

http://git.alpinelinux.org/aports/commit/?id=0fab8db7500d0c5f6eb28d74ecfc5d9e4fd379e3
http://git.alpinelinux.org/aports/commit/?id=eac7d0a6acaaa7d2ab03a2ce4bfe967a6bba9036
http://git.alpinelinux.org/aports/commit/?id=dc1cbe038e2494f5fa124e3d2942987672acafa6


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###