CVE-2017-7995

Published: May 3, 2017Modified: May 13, 2026

3.8

Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Exploitability: 2.0 / Impact: 1.4

Source: NVD

Description

Xen PV guest before Xen 4.3 checked access permissions to MMIO ranges only after accessing them, allowing host PCI device space memory reads, leading to information disclosure. This is an error in the get_user function. NOTE: the upstream Xen Project considers versions before 4.5.x to be EOL.

Affected (6)

Products: Xen: Xen · Novell: Suse Linux Enterprise Point Of Sale, Suse Linux Enterprise Server · Suse: Manager, Manager Proxy, Openstack Cloud

Xen

1 product

Xen

Novell

2 products

Suse Linux Enterprise Point Of Sale

Suse Linux Enterprise Server

3 products

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Xen Xen	Up to 4.2.5

Configuration B

5 vulnerable

Vulnerable Software	Affected Versions
Novell Suse Linux Enterprise Point Of Sale	Version 11.0 sp3
Novell Suse Linux Enterprise Server	Version 11.0 sp3
Suse Manager	Version 2.1
Suse Manager Proxy	Version 2.1
Suse Openstack Cloud	Version 5