CVE-2017-10911

2017-07-0400:00:00

ubuntu.com

6.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.9 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:C/I:N/A:N

0.001 Low

EPSS

Percentile

25.4%

JSON

The make_response function in drivers/block/xen-blkback/blkback.c in the
Linux kernel before 4.11.8 allows guest OS users to obtain sensitive
information from host OS (or other guest OS) kernel memory by leveraging
the copying of uninitialized padding fields in Xen block-interface response
structures, aka XSA-216.

OSVersionArchitecturePackageVersionFilename
ubuntu16.04noarchlinux-hwe< 4.10.0-38.42~16.04.1UNKNOWN
ubuntu14.04noarchqemu< 2.0.0+dfsg-2ubuntu1.35UNKNOWN
ubuntu16.04noarchqemu< 1:2.5+dfsg-5ubuntu10.15UNKNOWN
ubuntu17.04noarchqemu< 1:2.8+dfsg-3ubuntu2.4UNKNOWN
ubuntu14.04noarchlinux< 3.13.0-135.184UNKNOWN
ubuntu16.04noarchlinux< 4.4.0-98.121UNKNOWN
ubuntu17.04noarchlinux< 4.10.0-38.42UNKNOWN
ubuntu17.04noarchlinux-raspi2< 4.10.0-1020.23UNKNOWN
ubuntu16.04noarchlinux-raspi2< 4.4.0-1076.84UNKNOWN
ubuntu14.04noarchlinux-lts-xenial< 4.4.0-98.121~14.04.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	16.04	noarch	linux-hwe	< 4.10.0-38.42~16.04.1	UNKNOWN
ubuntu	14.04	noarch	qemu	< 2.0.0+dfsg-2ubuntu1.35	UNKNOWN
ubuntu	16.04	noarch	qemu	< 1:2.5+dfsg-5ubuntu10.15	UNKNOWN
ubuntu	17.04	noarch	qemu	< 1:2.8+dfsg-3ubuntu2.4	UNKNOWN
ubuntu	14.04	noarch	linux	< 3.13.0-135.184	UNKNOWN
ubuntu	16.04	noarch	linux	< 4.4.0-98.121	UNKNOWN
ubuntu	17.04	noarch	linux	< 4.10.0-38.42	UNKNOWN
ubuntu	17.04	noarch	linux-raspi2	< 4.10.0-1020.23	UNKNOWN
ubuntu	16.04	noarch	linux-raspi2	< 4.4.0-1076.84	UNKNOWN
ubuntu	14.04	noarch	linux-lts-xenial	< 4.4.0-98.121~14.04.1	UNKNOWN