CVE-2017-10911

The make_response function in drivers/block/xen-blkback/blkback.c in the Linux kernel before 4.11.8 allows guest OS users to obtain sensitive information from host OS (or other guest OS) kernel memory by leveraging the copying of uninitialized padding fields in Xen block-interface response structures, aka XSA-216.

CVSS v3.0 6.5 MEDIUM
CVSS v2.0 4.9 MEDIUM

6.5^/10

CVSS v3.0 : MEDIUM

Vector : AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Exploitability : 2.0 / Impact : 4.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

4.9^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:L/Au:N/C:C/I:N/A:N

Exploitability : 3.9 / Impact : 6.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://xenbits.xen.org/xsa/advisory-216.html	Mitigation Vendor Advisory
https://github.com/torvalds/linux/commit/089bc0143f489bd3a4578bdff5f4ca68fb26f341	Patch Third Party Advisory
http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.11.8	Mailing List Third Party Advisory
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=089bc0143f489bd3a4578bdff5f4ca68fb26f341	Mailing List Patch Third Party Advisory
http://www.securityfocus.com/bid/99162	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1038720	VDB Entry Third Party Advisory
https://security.gentoo.org/glsa/201708-03
http://www.debian.org/security/2017/dsa-3945
http://www.debian.org/security/2017/dsa-3927
http://www.debian.org/security/2017/dsa-3920
https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Information

Published : 2017-07-04 18:29

Updated : 2018-09-07 03:29

NVD link : CVE-2017-10911

Mitre link : CVE-2017-10911

JSON object : View

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

Advertisement

Products Affected

linux

linux_kernel

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://xenbits.xen.org/xsa/advisory-216.html", "name": "https://xenbits.xen.org/xsa/advisory-216.html", "tags": ["Mitigation", "Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "https://github.com/torvalds/linux/commit/089bc0143f489bd3a4578bdff5f4ca68fb26f341", "name": "https://github.com/torvalds/linux/commit/089bc0143f489bd3a4578bdff5f4ca68fb26f341", "tags": ["Patch", "Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.11.8", "name": "http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.11.8", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=089bc0143f489bd3a4578bdff5f4ca68fb26f341", "name": "http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=089bc0143f489bd3a4578bdff5f4ca68fb26f341", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "http://www.securityfocus.com/bid/99162", "name": "99162", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "BID"}, {"url": "http://www.securitytracker.com/id/1038720", "name": "1038720", "tags": ["VDB Entry", "Third Party Advisory"], "refsource": "SECTRACK"}, {"url": "https://security.gentoo.org/glsa/201708-03", "name": "GLSA-201708-03", "tags": [], "refsource": "GENTOO"}, {"url": "http://www.debian.org/security/2017/dsa-3945", "name": "DSA-3945", "tags": [], "refsource": "DEBIAN"}, {"url": "http://www.debian.org/security/2017/dsa-3927", "name": "DSA-3927", "tags": [], "refsource": "DEBIAN"}, {"url": "http://www.debian.org/security/2017/dsa-3920", "name": "DSA-3920", "tags": [], "refsource": "DEBIAN"}, {"url": "https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html", "name": "[debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update", "tags": [], "refsource": "MLIST"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The make_response function in drivers/block/xen-blkback/blkback.c in the Linux kernel before 4.11.8 allows guest OS users to obtain sensitive information from host OS (or other guest OS) kernel memory by leveraging the copying of uninitialized padding fields in Xen block-interface response structures, aka XSA-216."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-200"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2017-10911", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "COMPLETE"}, "severity": "MEDIUM", "impactScore": 6.9, "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "baseMetricV3": {"cvssV3": {"scope": "CHANGED", "version": "3.0", "baseScore": 6.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 2.0}}, "publishedDate": "2017-07-05T01:29Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "4.11.7"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-09-07T10:29Z"}