DEBIAN-CVE-2017-7995

Advisory lineage Upstream: 1 Downstream: 1
Upstream
CVE-2017-7995
Downstream
DLA-964-1
Published: 03 May 2017, 19:59
Last modified:28 Apr 2026, 20:17

Vulnerability Summary

Overall Risk (default)
low
15/100
CVSS Score
3.8 LOW
3.0 (osv_debian)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

03 May 2017, 19:59
Published
Vulnerability first disclosed
28 Apr 2026, 20:17
Last Modified
Vulnerability information updated

Description

Xen PV guest before Xen 4.3 checked access permissions to MMIO ranges only after accessing them, allowing host PCI device space memory reads, leading to information disclosure. This is an error in the get_user function. NOTE: the upstream Xen Project considers versions before 4.5.x to be EOL.

CVSS Metrics

  • v3.0•LOW•Score: 3.8CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Affected Systems

  • debian•xen

    < 4.3.0-1 | < 4.3.0-1 | < 4.3.0-1 | < 4.3.0-1

References (1)