CVE-2017-7228
Publication date 4 April 2017
Last updated 25 August 2025
Ubuntu priority
Description
An issue (known as XSA-212) was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix introduced an insufficient check on XENMEM_exchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arrays.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| xen | ||
| 16.04 LTS xenial |
Fixed 4.6.5-0ubuntu1.1
|
|
| 14.04 LTS trusty |
Fixed 4.4.2-0ubuntu0.14.04.11
|
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
8.2 · High
|
| Attack vector | Local |
| Attack complexity | Low |
| Privileges required | High |
| User interaction | None |
| Scope | Changed |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |