CVE-2017-14431

Published: 13 September 2017

Memory leak in Xen 3.3 through 4.8.x allows guest OS users to cause a denial of service (ARM or x86 AMD host OS memory consumption) by continually rebooting, because certain cleanup is skipped if no pass-through device was ever assigned, aka XSA-207.

Priority

Cvss 3 Severity Score

5.5

Score breakdown

Status

Package	Release	Status
xen Launchpad, Ubuntu, Debian	trusty	Released (4.4.2-0ubuntu0.14.04.11)
	upstream	Needs triage
	xenial	Released (4.6.5-0ubuntu1)
	zesty	Released (4.8.0-1ubuntu2.1)
	Binaries built from this source package are in Universe and so are supported by the community.

Severity score breakdown

Parameter	Value
Base score	5.5
Attack vector	Local
Attack complexity	Low
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	None
Availability impact	High
Vector	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

Bugs

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=856229

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›