CVE-2017-15596

An issue was discovered in Xen 4.4.x through 4.9.x allowing ARM guest OS users to cause a denial...

6.0 MediumFix available

CVE-2017-15596 is a medium vulnerability (CVSS 6.0) in Xen, published September 12, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 30th percentile. Fixed in xen 4.6.6-r2.

An issue was discovered in Xen 4.4.x through 4.9.x allowing ARM guest OS users to cause a denial of service (prevent physical CPU usage) because of lock mishandling upon detection of an add-to-physmap error.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.37%Down 0.7 points since Apr 14, 2021

What each source reports

NVD Score used 6.0

Record: CVE-2017-15596
CVSS 3.0: 6.0 MediumCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
CVSS 2.0: 4.9 MediumAV:L/AC:L/Au:N/C:N/I:N/A:C
Weakness: CWE-400
Updated: 2026-11-02

CVE List No score

Record: CVE-2017-15596
Updated: 2026-11-02

EUVDEUVD-2017-7048 No score

Record: EUVD-2017-7048
Updated: 2026-11-03

GitHub AdvisoriesGHSA-9vx2-2784-8w2r 6.0

An issue was discovered in Xen 4.4.x through 4.9.x allowing ARM guest OS users to cause a denial...

Record: GHSA-9vx2-2784-8w2r
CVSS 3.0: 6.0 MediumCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
Weakness: CWE-400
Updated: 2026-11-02

OSVALPINE-CVE-2017-15596 6.0

Record: ALPINE-CVE-2017-15596
CVSS 3.0: 6.0 MediumCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
Updated: 2026-11-02

OSV 6.0

Record: CVE-2017-15596
CVSS 3.0: 6.0 MediumCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2017-15596 6.0

Record: DEBIAN-CVE-2017-15596
CVSS 3.0: 6.0 MediumCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2017-15596 6.0

Record: UBUNTU-CVE-2017-15596
CVSS 3.0: 6.0 MediumCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`xen` Alpine:v3.4	before 4.6.6-r2	4.6.6-r2
`xen` Alpine:v3.5	before 4.7.3-r3	4.7.3-r3
`xen` Alpine:v3.6	before 4.8.2-r0	4.8.2-r0
`xen` Debian:12	before 4.8.1-1+deb9u3	4.8.1-1+deb9u3
`xen` Debian:13	before 4.8.1-1+deb9u3	4.8.1-1+deb9u3
`xen` Debian:14	before 4.8.1-1+deb9u3	4.8.1-1+deb9u3
`xen` Debian:8	before 4.4.1-9+deb8u10, plus listed versions 4.4.1-94.4.1-9+deb8u14.4.1-9+deb8u24.4.1-9+deb8u34.4.1-9+deb8u4 Show 5 moreShow less 4.4.1-9+deb8u54.4.1-9+deb8u64.4.1-9+deb8u74.4.1-9+deb8u84.4.1-9+deb8u9	4.4.1-9+deb8u10
`xen` Debian:9	before 4.8.1-1+deb9u3, plus listed versions 4.8.1-1+deb9u14.8.1-1+deb9u2	4.8.1-1+deb9u3
`xen` Ubuntu:18.04:LTS	before 4.9.2-0ubuntu1, plus listed versions 4.9.0-0ubuntu34.9.0-0ubuntu4	4.9.2-0ubuntu1

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV