The xen_biovec_phys_mergeable function in drivers/xen/biomerge.c in Xen might allow local OS guest users to corrupt block device data streams and consequently obtain sensitive memory information, cause a denial of service, or gain host OS privileges by leveraging incorrect block IO merge-ability calculation.
CVSS Details
- CVSS 3.0 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade xen | Oct 30, 2017 | Aug 24, 2017 |
| Amazon_linux | — | Upgrade kernel | Sep 18, 2017 | Aug 23, 2017 |
| Debian | — | Upgrade linux | Sep 25, 2017 | Aug 23, 2017 |
| Gentoo Linux | — | Upgrade app-emulation/xen.Upgrade app-emulation/xen-tools. | Jan 15, 2018 | Aug 24, 2017 |
| Huawei Euleros 2_0_sp3 | — | Upgrade kernelUpgrade kernel-headersUpgrade kernel-debuginfoUpgrade kernel-develUpgrade kernel-debuginfo-common-x86_64Upgrade python-perfUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade perf | Apr 16, 2020 | Aug 24, 2017 |
| Huawei Euleros 2_0_sp5 | — | Upgrade kernel-headersUpgrade kernelUpgrade perfUpgrade kernel-toolsUpgrade kernel-develUpgrade kernel-tools-libsUpgrade python-perf | Dec 27, 2019 | Aug 24, 2017 |
| Oracle_linux | — | Upgrade kernel-uek | Aug 24, 2017 | Aug 15, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Aug 15, 2017 |
| Suse | — | Upgrade kernel-obs-buildUpgrade ocfs2-kmp-defaultUpgrade gfs2-kmp-defaultUpgrade dlm-kmp-defaultUpgrade kernel-defaultUpgrade cluster-md-kmp-defaultUpgrade cluster-network-kmp-defaultUpgrade kernel-docs | Sep 7, 2017 | Aug 23, 2017 |
| Ubuntu | — | Upgrade linux-image-powerpc64-embUpgrade linux-image-powerpc-e500mcUpgrade linux-image-4.4.0-1032-gkeUpgrade linux-image-generic-lts-xenialUpgrade linux-image-generic-lpaeUpgrade linux-image-powerpc-e500Upgrade linux-image-lowlatencyUpgrade linux-image-gkeUpgrade linux-image-3.13.0-149-generic-lpaeUpgrade linux-image-genericUpgrade linux-image-4.4.0-97-powerpc-e500mcUpgrade linux-image-3.13.0-149-powerpc-smpUpgrade linux-image-3.13.0-149-powerpc-e500mcUpgrade linux-image-4.4.0-1008-kvmUpgrade linux-image-generic-lpae-lts-trustyUpgrade linux-image-powerpc-smpUpgrade linux-image-4.4.0-97-powerpc64-embUpgrade linux-image-4.4.0-1075-raspi2Upgrade linux-image-snapdragonUpgrade linux-image-3.13.0-149-powerpc64-smpUpgrade linux-image-3.13.0-149-powerpc64-embUpgrade linux-image-4.4.0-97-powerpc-smpUpgrade linux-image-generic-lpae-lts-xenialUpgrade linux-image-3.13.0-149-genericUpgrade linux-image-4.4.0-1038-awsUpgrade linux-image-4.4.0-97-genericUpgrade linux-image-powerpc-smp-lts-xenialUpgrade linux-image-4.4.0-97-lowlatencyUpgrade linux-image-kvmUpgrade linux-image-powerpc64-smp-lts-xenialUpgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-4.4.0-1077-snapdragonUpgrade linux-image-awsUpgrade linux-image-powerpc64-smpUpgrade linux-image-3.13.0-149-powerpc-e500Upgrade linux-image-3.13.0-149-lowlatencyUpgrade linux-image-4.4.0-97-generic-lpaeUpgrade linux-image-4.4.0-97-powerpc64-smpUpgrade linux-image-powerpc64-emb-lts-xenialUpgrade linux-image-powerpc-e500mc-lts-xenialUpgrade linux-image-generic-lts-trustyUpgrade linux-image-raspi2 | Oct 11, 2017 | Aug 23, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub