CVE-2017-10917

Critical

Published: 05/07/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Xen versions up to 4.8.x do not validate the port numbers of polled event channel ports, allowing guest OS users to cause a denial of service (NULL pointer dereference and host OS crash) or possibly obtain sensitive information.

Risk Assessment

This vulnerability may lead to host system crashes, affecting service availability and potentially exposing sensitive data.

Recommendation

It is recommended to upgrade to the latest version of Xen that includes security patches addressing this vulnerability.

Original NVD description (English source)

Xen through 4.8.x does not validate the port numbers of polled event channel ports, which allows guest OS users to cause a denial of service (NULL pointer dereference and host OS crash) or possibly obtain sensitive information, aka XSA-221.