Back
CVE-2017-7995
Xen PV guest before Xen 4.3 checked access permissions to MMIO ranges only after accessing them, allowing host PCI device space memory…
Low3.8EPSS 0.37%
- Published
- Updated
- Reserved
- Assigned by
- mitre
Description
Xen PV guest before Xen 4.3 checked access permissions to MMIO ranges only after accessing them, allowing host PCI device space memory reads, leading to information disclosure. This is an error in the get_user function. NOTE: the upstream Xen Project considers versions before 4.5.x to be EOL.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.0 | Low3.8 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N |
- EPSS (exploitation in 30 days)
- 0.37% · top 69% of all CVEs (2 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 3.8.
Weakness
Affected products
n/a
- affected n/a
References (3)
- 98314 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
- https://bugzilla.suse.com/show_bug.cgi?id=1033948 (opens in a new tab)x_refsource_CONFIRMx_transferred
- http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00005.html (opens in a new tab)x_refsource_CONFIRMx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Record last updated .