6.5

CVE-2017-10923

Xen through 4.8.x does not validate a vCPU array index upon the sending of an SGI, which allows guest OS users to cause a denial of service (hypervisor crash), aka XSA-225.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Xen ≫ Xen Version4.6.0
Xen ≫ Xen Version4.6.1
Xen ≫ Xen Version4.6.2
Xen ≫ Xen Version4.6.4
Xen ≫ Xen Version4.6.5
Xen ≫ Xen Version4.7.1
Xen ≫ Xen Version4.8.0
Xen ≫ Xen Version4.8.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.8% 0.757
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 2.8 3.6
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://security.gentoo.org/glsa/201708-03
http://www.securityfocus.com/bid/99160
VDB Entry
Tool Signature
http://www.securitytracker.com/id/1038735
Third Party Advisory
VDB Entry
https://xenbits.xen.org/xsa/advisory-225.html
Vendor Advisory
Mailing List
Mitigation