← back
CVE-2017-7228

CVE-2017-7228

EPSS 1.6%
An issue (known as XSA-212) was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix introduced an insufficient check on XENMEM_exchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arrays.
Affected products
n/a · n/a
public PoCs found — 2
cve_referencewww.exploit-db.com/exploits/41870/unverifiedexploitdbwww.exploit-db.com/exploits/41870unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://openwall.com/lists/oss-security/2017/04/04/3https://github.com/QubesOS/qubes-secpack/blob/master/QSBs/qsb-029-2017.txthttps://googleprojectzero.blogspot.com/2017/04/pandavirtualization-exploiting-xen.htmlhttps://www.exploit-db.com/exploits/41870/http://www.debian.org/security/2017/dsa-3847http://www.securityfocus.com/bid/97375http://www.securitytracker.com/id/1038223http://xenbits.xen.org/xsa/advisory-212.html