{"id":"CVE-2017-12855","aliases":["ALPINE-CVE-2017-12855","DEBIAN-CVE-2017-12855","DLA-1132-1","DSA-3969-1","EUVD-2017-4390","GHSA-c6pm-8crm-3rr8","SUSE-SU-2017:2326-1","SUSE-SU-2017:2327-1","SUSE-SU-2017:2327-2","SUSE-SU-2017:2339-1","SUSE-SU-2017:2450-1","SUSE-SU-2017:2541-1","UBUNTU-CVE-2017-12855"],"status":"published","title":"Xen maintains the _GTF_{read,writ}ing bits as appropriate, to inform the guest that a grant is in...","description":"Xen maintains the _GTF_{read,writ}ing bits as appropriate, to inform the guest that a grant is in use. A guest is expected not to modify the grant details while it is in use, whereas the guest is free to modify/reuse the grant entry when it is not in use. Under some circumstances, Xen will clear the status bits too early, incorrectly informing the guest that the grant is no longer in use. A guest may prematurely believe that a granted frame is safely private again, and reuse it in a way which contains sensitive information, while the domain on the far end of the grant is still using the grant. Xen 4.9, 4.8, 4.7, 4.6, and 4.5 are affected.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.00398,"percentile":0.34289,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2017-08-15T16:00:00Z","modified":"2026-09-01T20:03:42Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"xen","fixed_in":["4.9.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"xen","fixed_in":["4.9.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"xen","fixed_in":["4.9.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"xen","fixed_in":["4.9.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"xen","fixed_in":["4.9.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"xen","fixed_in":["4.9.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"xen","fixed_in":["4.9.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"xen","fixed_in":["4.9.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"xen","fixed_in":["4.9.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"xen","fixed_in":["4.9.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"xen","fixed_in":["4.9.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"xen","fixed_in":["4.9.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"xen","fixed_in":["4.9.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"xen","fixed_in":["4.9.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"xen","fixed_in":["4.9.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.3","package":"xen","fixed_in":["4.6.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.4","package":"xen","fixed_in":["4.6.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"xen","fixed_in":["4.7.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"xen","fixed_in":["4.8.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"xen","fixed_in":["4.9.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"xen","fixed_in":["4.9.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"xen","fixed_in":["4.9.0-r1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"xen","fixed_in":["4.8.1-1+deb9u3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xen","fixed_in":["4.8.1-1+deb9u3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xen","fixed_in":["4.8.1-1+deb9u3"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"xen","fixed_in":["4.4.2-0ubuntu0.14.04.14"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"xen","fixed_in":["4.6.5-0ubuntu1.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.3","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.0-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.1-1+deb9u3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.1-1+deb9u3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.1-1+deb9u3"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.6.lts1-9"}]}],"versions":["4.1.4-3","4.1.4-3+deb7u1","4.1.4-3+deb7u2","4.1.4-3+deb7u3","4.1.4-3+deb7u4","4.1.4-3+deb7u5","4.1.4-3+deb7u6","4.1.4-3+deb7u7","4.1.4-3+deb7u8","4.1.4-3+deb7u9","4.1.4-4","4.1.6.1-1+deb7u1","4.1.6.lts1-1","4.1.6.lts1-2","4.1.6.lts1-3","4.1.6.lts1-4","4.1.6.lts1-5","4.1.6.lts1-6","4.1.6.lts1-7","4.1.6.lts1-8"],"bundled":15},{"source":"osv","ecosystem":"Debian:8","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.1-9+deb8u10"}]}],"versions":["4.4.1-9","4.4.1-9+deb8u1","4.4.1-9+deb8u2","4.4.1-9+deb8u3","4.4.1-9+deb8u4","4.4.1-9+deb8u5","4.4.1-9+deb8u6","4.4.1-9+deb8u7","4.4.1-9+deb8u8","4.4.1-9+deb8u9"],"bundled":13},{"source":"osv","ecosystem":"Debian:9","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.1-1+deb9u3"}]}],"versions":["4.8.1-1+deb9u1","4.8.1-1+deb9u2"],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.3_03-43.9.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.3_03-43.9.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.3_03-43.9.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.3_03-43.9.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.0_11-3.9.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.0_11-3.9.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.0_11-3.9.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.0_11-3.9.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.5_21-45.5.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.5_21-45.5.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_22-61.9.2"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_22-61.9.2"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_22-61.9.2"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_22-22.51.2"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_22-22.51.2"}]}],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.2-0ubuntu0.14.04.14"}]}],"versions":["4.3.0-1ubuntu1","4.3.0-1ubuntu2","4.3.0-1ubuntu3","4.3.0-1ubuntu4","4.3.0-1ubuntu5","4.4.0-0ubuntu3","4.4.0-0ubuntu4","4.4.0-0ubuntu5","4.4.0-0ubuntu5.1","4.4.0-0ubuntu5.2","4.4.1-0ubuntu0.14.04.1","4.4.1-0ubuntu0.14.04.2","4.4.1-0ubuntu0.14.04.3","4.4.1-0ubuntu0.14.04.4","4.4.1-0ubuntu0.14.04.5","4.4.1-0ubuntu0.14.04.6","4.4.2-0ubuntu0.14.04.1","4.4.2-0ubuntu0.14.04.2","4.4.2-0ubuntu0.14.04.3","4.4.2-0ubuntu0.14.04.4","4.4.2-0ubuntu0.14.04.5","4.4.2-0ubuntu0.14.04.6","4.4.2-0ubuntu0.14.04.7","4.4.2-0ubuntu0.14.04.9","4.4.2-0ubuntu0.14.04.10","4.4.2-0ubuntu0.14.04.11","4.4.2-0ubuntu0.14.04.12"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.5-0ubuntu1.4"}]}],"versions":["4.5.1-0ubuntu1","4.5.1-0ubuntu2","4.6.0-1ubuntu1","4.6.0-1ubuntu2","4.6.0-1ubuntu4","4.6.0-1ubuntu4.1","4.6.0-1ubuntu4.2","4.6.0-1ubuntu4.3","4.6.5-0ubuntu1","4.6.5-0ubuntu1.1","4.6.5-0ubuntu1.2"]}],"products":[{"vendor":"xen","product":"xen"}],"references":[{"url":"https://support.citrix.com/article/CTX225941","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.securitytracker.com/id/1039177","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.securityfocus.com/bid/100341","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.debian.org/security/2017/dsa-3969","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-230.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-12855"},{"url":"https://github.com/advisories/GHSA-c6pm-8crm-3rr8"},{"url":"https://security.alpinelinux.org/vuln/CVE-2017-12855","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-12855","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172326-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1002573","tags":["report"]},{"url":"https://bugzilla.suse.com/1026236","tags":["report"]},{"url":"https://bugzilla.suse.com/1035231","tags":["report"]},{"url":"https://bugzilla.suse.com/1037840","tags":["report"]},{"url":"https://bugzilla.suse.com/1046637","tags":["report"]},{"url":"https://bugzilla.suse.com/1049578","tags":["report"]},{"url":"https://bugzilla.suse.com/1051787","tags":["report"]},{"url":"https://bugzilla.suse.com/1051788","tags":["report"]},{"url":"https://bugzilla.suse.com/1051789","tags":["report"]},{"url":"https://bugzilla.suse.com/1052686","tags":["report"]},{"url":"https://bugzilla.suse.com/1055695","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10664","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12137","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12855","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172327-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1027519","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172327-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172339-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1048920","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11334","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172450-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1032598","tags":["report"]},{"url":"https://bugzilla.suse.com/1037413","tags":["report"]},{"url":"https://bugzilla.suse.com/1047675","tags":["report"]},{"url":"https://bugzilla.suse.com/1056278","tags":["report"]},{"url":"https://bugzilla.suse.com/1056281","tags":["report"]},{"url":"https://bugzilla.suse.com/1056282","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14317","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14319","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172541-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-12855","tags":["report"]},{"url":"https://xenbits.xen.org/xsa/advisory-230.html","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-12855","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-12855","description":"Xen maintains the _GTF_{read,writ}ing bits as appropriate, to inform the guest that a grant is in use. A guest is expected not to modify the grant details while it is in use, whereas the guest is free to modify/reuse the grant entry when it is not in use. Under some circumstances, Xen will clear the status bits too early, incorrectly informing the guest that the grant is no longer in use. A guest may prematurely believe that a granted frame is safely private again, and reuse it in a way which contains sensitive information, while the domain on the far end of the grant is still using the grant. Xen 4.9, 4.8, 4.7, 4.6, and 4.5 are affected.","status":"published","published":"2017-08-15T16:00:00Z","modified":"2024-08-05T18:51:06.836Z","updated_at":"2026-11-02T14:33:17.59533Z"}],"euvd":[{"id":"EUVD-2017-4390","description":"Xen maintains the _GTF_{read,writ}ing bits as appropriate, to inform the guest that a grant is in use. A guest is expected not to modify the grant details while it is in use, whereas the guest is free to modify/reuse the grant entry when it is not in use. Under some circumstances, Xen will clear the status bits too early, incorrectly informing the guest that the grant is no longer in use. A guest may prematurely believe that a granted frame is safely private again, and reuse it in a way which contains sensitive information, while the domain on the far end of the grant is still using the grant. Xen 4.9, 4.8, 4.7, 4.6, and 4.5 are affected.","status":"published","published":"2017-08-15T16:00:00Z","modified":"2024-08-05T18:51:06Z","updated_at":"2026-11-03T02:23:20.155596Z"}],"ghsa":[{"id":"GHSA-c6pm-8crm-3rr8","title":"Xen maintains the _GTF_{read,writ}ing bits as appropriate, to inform the guest that a grant is in...","description":"Xen maintains the _GTF_{read,writ}ing bits as appropriate, to inform the guest that a grant is in use. A guest is expected not to modify the grant details while it is in use, whereas the guest is free to modify/reuse the grant entry when it is not in use. Under some circumstances, Xen will clear the status bits too early, incorrectly informing the guest that the grant is no longer in use. A guest may prematurely believe that a granted frame is safely private again, and reuse it in a way which contains sensitive information, while the domain on the far end of the grant is still using the grant. Xen 4.9, 4.8, 4.7, 4.6, and 4.5 are affected.","status":"published","published":"2022-05-17T00:24:10Z","modified":"2023-02-03T05:01:38Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:53:01.051702Z"}],"nvd":[{"id":"CVE-2017-12855","description":"Xen maintains the _GTF_{read,writ}ing bits as appropriate, to inform the guest that a grant is in use. A guest is expected not to modify the grant details while it is in use, whereas the guest is free to modify/reuse the grant entry when it is not in use. Under some circumstances, Xen will clear the status bits too early, incorrectly informing the guest that the grant is no longer in use. A guest may prematurely believe that a granted frame is safely private again, and reuse it in a way which contains sensitive information, while the domain on the far end of the grant is still using the grant. Xen 4.9, 4.8, 4.7, 4.6, and 4.5 are affected.","status":"published","published":"2017-08-15T16:29:00.233Z","modified":"2026-06-17T01:04:01.93Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:03:57.82609Z"}],"osv":[{"id":"ALPINE-CVE-2017-12855","description":"Xen maintains the _GTF_{read,writ}ing bits as appropriate, to inform the guest that a grant is in use. A guest is expected not to modify the grant details while it is in use, whereas the guest is free to modify/reuse the grant entry when it is not in use. Under some circumstances, Xen will clear the status bits too early, incorrectly informing the guest that the grant is no longer in use. A guest may prematurely believe that a granted frame is safely private again, and reuse it in a way which contains sensitive information, while the domain on the far end of the grant is still using the grant. Xen 4.9, 4.8, 4.7, 4.6, and 4.5 are affected.","status":"published","published":"2017-08-15T16:29:00.233Z","modified":"2026-06-15T18:18:06.764614561Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:46.716249Z"},{"id":"CVE-2017-12855","description":"Xen maintains the _GTF_{read,writ}ing bits as appropriate, to inform the guest that a grant is in use. A guest is expected not to modify the grant details while it is in use, whereas the guest is free to modify/reuse the grant entry when it is not in use. Under some circumstances, Xen will clear the status bits too early, incorrectly informing the guest that the grant is no longer in use. A guest may prematurely believe that a granted frame is safely private again, and reuse it in a way which contains sensitive information, while the domain on the far end of the grant is still using the grant. Xen 4.9, 4.8, 4.7, 4.6, and 4.5 are affected.","status":"published","published":"2017-08-15T16:29:00.233Z","modified":"2026-03-14T14:19:32.330615Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:04.159616Z"},{"id":"DEBIAN-CVE-2017-12855","description":"Xen maintains the _GTF_{read,writ}ing bits as appropriate, to inform the guest that a grant is in use. A guest is expected not to modify the grant details while it is in use, whereas the guest is free to modify/reuse the grant entry when it is not in use. Under some circumstances, Xen will clear the status bits too early, incorrectly informing the guest that the grant is no longer in use. A guest may prematurely believe that a granted frame is safely private again, and reuse it in a way which contains sensitive information, while the domain on the far end of the grant is still using the grant. Xen 4.9, 4.8, 4.7, 4.6, and 4.5 are affected.","status":"published","published":"2017-08-15T16:29:00.233Z","modified":"2026-09-01T20:03:42.63090378Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:28.50097Z"},{"id":"UBUNTU-CVE-2017-12855","description":"Xen maintains the _GTF_{read,writ}ing bits as appropriate, to inform the guest that a grant is in use. A guest is expected not to modify the grant details while it is in use, whereas the guest is free to modify/reuse the grant entry when it is not in use. Under some circumstances, Xen will clear the status bits too early, incorrectly informing the guest that the grant is no longer in use. A guest may prematurely believe that a granted frame is safely private again, and reuse it in a way which contains sensitive information, while the domain on the far end of the grant is still using the grant. Xen 4.9, 4.8, 4.7, 4.6, and 4.5 are affected.","status":"published","published":"2017-08-15T16:29:00Z","modified":"2026-04-22T11:13:23.599811Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:14.122973Z"},{"id":"DLA-1132-1","title":"xen - security update","status":"published","published":"2017-10-11T00:00:00Z","modified":"2026-03-09T01:01:31.219478Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DSA-3969-1","title":"xen - security update","status":"published","published":"2017-09-12T00:00:00Z","modified":"2026-03-09T01:19:19.676084Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"SUSE-SU-2017:2326-1","title":"Security update for xen","description":"This update for xen to version 4.7.3 fixes several issues.\n\nThese security issues were fixed:\n\n- CVE-2017-12135: Unbounded recursion in grant table code allowed a malicious\n  guest to crash the host or potentially escalate privileges/leak information\n  (XSA-226, bsc#1051787).\n- CVE-2017-12137: Incorrectly-aligned updates to pagetables allowed for\n  privilege escalation (XSA-227, bsc#1051788).\n- CVE-2017-12136: Race conditions with maptrack free list handling allows a\n  malicious guest administrator to crash the host or escalate their privilege to\n  that of the host (XSA-228, bsc#1051789).\n- CVE-2017-11434: The dhcp_decode function in slirp/bootp.c allowed local guest\n  OS users to cause a denial of service (out-of-bounds read) via a crafted DHCP\n  options string (bsc#1049578).\n- CVE-2017-10664: qemu-nbd did not ignore SIGPIPE, which allowed remote\n  attackers to cause a denial of service (daemon crash) by disconnecting during a\n  server-to-client reply attempt (bsc#1046637).\n- CVE-2017-12855: Premature clearing of GTF_writing / GTF_reading lead to\n  potentially leaking sensitive information (XSA-230 CVE-2017-12855).\n\nThese non-security issues were fixed:\n\n- bsc#1055695: XEN: 11SP4 and 12SP3 HVM guests can not be restored after the save using xl stack \n- bsc#1035231: Migration of HVM domU did not use superpages on destination dom0\n- bsc#1002573: Optimized LVM functions in block-dmmd block-dmmd\n- bsc#1037840: Xen-detect always showed HVM for PV guests\n","status":"published","published":"2017-09-01T11:20:51Z","modified":"2026-02-04T04:24:47.466329Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2017:2327-1","title":"Security update for xen","description":"This update for xen fixes several issues.\n\nThese security issues were fixed:\n\n- CVE-2017-12135: Unbounded recursion in grant table code allowed a malicious\n  guest to crash the host or potentially escalate privileges/leak information\n  (XSA-226, bsc#1051787).\n- CVE-2017-12137: Incorrectly-aligned updates to pagetables allowed for\n  privilege escalation (XSA-227, bsc#1051788).\n- CVE-2017-12136: Race conditions with maptrack free list handling allows a\n  malicious guest administrator to crash the host or escalate their privilege to\n  that of the host (XSA-228, bsc#1051789).\n- CVE-2017-11434: The dhcp_decode function in slirp/bootp.c allowed local guest\n  OS users to cause a denial of service (out-of-bounds read) via a crafted DHCP\n  options string (bsc#1049578).\n- CVE-2017-10664: qemu-nbd did not ignore SIGPIPE, which allowed remote\n  attackers to cause a denial of service (daemon crash) by disconnecting during a\n  server-to-client reply attempt (bsc#1046637).\n- CVE-2017-12855: Premature clearing of GTF_writing / GTF_reading lead to\n  potentially leaking sensitive information (XSA-230 bsc#1052686.\n\nThese non-security issues were fixed:\n\n- bsc#1055695: XEN: 11SP4 and 12SP3 HVM guests can not be restored after the save using xl stack\n- bsc#1035231: Migration of HVM domU did not use superpages on destination dom0\n- bsc#1002573: Optimized LVM functions in block-dmmd block-dmmd\n","status":"published","published":"2017-11-16T10:21:09Z","modified":"2025-05-02T04:06:04.282703Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2017:2327-2","title":"Security update for xen","description":"This update for xen fixes several issues.\n\nThese security issues were fixed:\n\n- CVE-2017-12135: Unbounded recursion in grant table code allowed a malicious\n  guest to crash the host or potentially escalate privileges/leak information\n  (XSA-226, bsc#1051787).\n- CVE-2017-12137: Incorrectly-aligned updates to pagetables allowed for\n  privilege escalation (XSA-227, bsc#1051788).\n- CVE-2017-12136: Race conditions with maptrack free list handling allows a\n  malicious guest administrator to crash the host or escalate their privilege to\n  that of the host (XSA-228, bsc#1051789).\n- CVE-2017-11434: The dhcp_decode function in slirp/bootp.c allowed local guest\n  OS users to cause a denial of service (out-of-bounds read) via a crafted DHCP\n  options string (bsc#1049578).\n- CVE-2017-10664: qemu-nbd did not ignore SIGPIPE, which allowed remote\n  attackers to cause a denial of service (daemon crash) by disconnecting during a\n  server-to-client reply attempt (bsc#1046637).\n- CVE-2017-12855: Premature clearing of GTF_writing / GTF_reading lead to\n  potentially leaking sensitive information (XSA-230 bsc#1052686.\n\nThese non-security issues were fixed:\n\n- bsc#1055695: XEN: 11SP4 and 12SP3 HVM guests can not be restored after the save using xl stack\n- bsc#1035231: Migration of HVM domU did not use superpages on destination dom0\n- bsc#1002573: Optimized LVM functions in block-dmmd block-dmmd\n","status":"published","published":"2017-11-16T10:21:10Z","modified":"2026-02-04T02:44:42.758094Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2017:2339-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2017-12855: Premature clearing of GTF_writing / GTF_reading lead to\n  potentially leaking sensitive information (XSA-230, bsc#1052686).\n- CVE-2017-12135: Unbounded recursion in grant table code allowed a malicious\n  guest to crash the host or potentially escalate privileges/leak information\n  (XSA-226, bsc#1051787).\n- CVE-2017-12137: Incorrectly-aligned updates to pagetables allowed for\n  privilege escalation (XSA-227, bsc#1051788).\n- CVE-2017-11334: The address_space_write_continue function in exec.c allowed\n  local guest OS privileged users to cause a denial of service (out-of-bounds\n  access and guest instance crash) by leveraging use of qemu_map_ram_ptr to\n  access guest ram block area (bsc#1048920).\n- CVE-2017-11434: The dhcp_decode function in slirp/bootp.c allowed local guest\n  OS users to cause a denial of service (out-of-bounds read) via a crafted DHCP\n  options string (bsc#1049578).\n- CVE-2017-10664: qemu-nbd did not ignore SIGPIPE, which allowed remote\n  attackers to cause a denial of service (daemon crash) by disconnecting during\n  a server-to-client reply attempt (bsc#1046637).\n","status":"published","published":"2017-09-04T11:12:18Z","modified":"2026-02-04T04:09:55.77813Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2017:2450-1","title":"Security update for xen","description":"This update for xen fixes several issues.\n\nThese security issues were fixed:\n\n- CVE-2017-12135: Unbounded recursion in grant table code allowed a malicious\n  guest to crash the host or potentially escalate privileges/leak information\n  (XSA-226, bsc#1051787).\n- CVE-2017-12137: Incorrectly-aligned updates to pagetables allowed for\n  privilege escalation (XSA-227, bsc#1051788).\n- CVE-2017-11334: The address_space_write_continue function in exec.c allowed\n  local guest OS privileged users to cause a denial of service (out-of-bounds\n  access and guest instance crash) by leveraging use of qemu_map_ram_ptr to\n  access guest ram block area (bsc#1048920).\n- CVE-2017-11434: The dhcp_decode function in slirp/bootp.c allowed local guest\n  OS users to cause a denial of service (out-of-bounds read) via a crafted DHCP\n  options string (bsc#1049578).\n- CVE-2017-10806: Stack-based buffer overflow in hw/usb/redirect.c allowed\n  local guest OS users to cause a denial of service via vectors related to\n  logging debug messages (bsc#1047675).\n- CVE-2017-10664: qemu-nbd did not ignore SIGPIPE, which allowed remote\n  attackers to cause a denial of service (daemon crash) by disconnecting during\n  a server-to-client reply attempt (bsc#1046637).\n- CVE-2017-12855: Premature clearing of GTF_writing / GTF_reading lead to\n  potentially leaking sensitive information (XSA-230, bsc#1052686).\n- CVE-2017-14316: Missing bound check in function `alloc_heap_pages` for an\n  internal array allowed attackers using crafted hypercalls to execute\n  arbitrary code within Xen (XSA-231, bsc#1056278)\n- CVE-2017-14317: A race in cxenstored may have cause a double-free allowind for\n  DoS of the xenstored daemon (XSA-233, bsc#1056281).\n- CVE-2017-14319: An error while handling grant mappings allowed malicious or\n  buggy x86 PV guest to escalate its privileges or crash the hypervisor (XSA-234,\n  bsc#1056282).\n\nThis non-security issue was fixed:\n\n- bsc#1032598: Prevent removal of NVME devices\n- bsc#1037413: Support for newer intel cpu's, mwait-idle driver and skylake\n","status":"published","published":"2017-09-13T12:41:08Z","modified":"2026-02-04T04:28:29.800144Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2017:2541-1","title":"Security update for xen","description":"This update for xen fixes several issues.\n\nThese security issues were fixed:\n\n- CVE-2017-12135: Unbounded recursion in grant table code allowed a malicious\n  guest to crash the host or potentially escalate privileges/leak information\n  (XSA-226, bsc#1051787).\n- CVE-2017-12137: Incorrectly-aligned updates to pagetables allowed for\n  privilege escalation (XSA-227, bsc#1051788).\n- CVE-2017-11334: The address_space_write_continue function in exec.c allowed\n  local guest OS privileged users to cause a denial of service (out-of-bounds\n  access and guest instance crash) by leveraging use of qemu_map_ram_ptr to\n  access guest ram block area (bsc#1048920).\n- CVE-2017-11434: The dhcp_decode function in slirp/bootp.c allowed local guest\n  OS users to cause a denial of service (out-of-bounds read) via a crafted DHCP\n  options string (bsc#1049578).\n- CVE-2017-10806: Stack-based buffer overflow in hw/usb/redirect.c allowed\n  local guest OS users to cause a denial of service via vectors related to\n  logging debug messages (bsc#1047675).\n- CVE-2017-10664: qemu-nbd did not ignore SIGPIPE, which allowed remote\n  attackers to cause a denial of service (daemon crash) by disconnecting during \n  a server-to-client reply attempt (bsc#1046637).\n- CVE-2017-12855: Premature clearing of GTF_writing / GTF_reading lead to\n  potentially leaking sensitive information (XSA-230, bsc#1052686).\n- CVE-2017-14316: Missing bound check in function `alloc_heap_pages` for an\n  internal array allowed attackers using crafted hypercalls to execute\n  arbitrary code within Xen (XSA-231, bsc#1056278)\n- CVE-2017-14317: A race in cxenstored may have cause a double-free allowind for\n  DoS of the xenstored daemon (XSA-233, bsc#1056281).\n- CVE-2017-14319: An error while handling grant mappings allowed malicious or\n  buggy x86 PV guest to escalate its privileges or crash the hypervisor (XSA-234,\n  bsc#1056282).\n\nThese non-security issues were fixed:\n\n- bsc#1002573: Optimized LVM functions in block-dmmd block-dmmd\n- bsc#1032598: Prevent removal of NVME devices\n- bsc#1037413: Support for newer intel cpu's, mwait-idle driver and skylake\n","status":"published","published":"2017-09-21T15:30:58Z","modified":"2026-02-04T02:56:21.743107Z","updated_at":"2026-11-02T15:53:44.209561Z"}]}}