CVE-2017-14316 Details
Description
A parameter verification issue was discovered in Xen through 4.9.x. The function `alloc_heap_pages` allows callers to specify the first NUMA node that should be used for allocations through the `memflags` parameter; the node is extracted using the `MEMF_get_node` macro. While the function checks to see if the special constant `NUMA_NO_NODE` is specified, it otherwise does not handle the case where `node >= MAX_NUMNODES`. This allows an out-of-bounds access to an internal array.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://lists.debian.org/debian-lts-announce/2018/10/msg00009.html | CVE | |
| https://support.citrix.com/article/CTX227185 | CVE | |
| https://www.debian.org/security/2017/dsa-4050 | CVE | |
| http://www.securityfocus.com/bid/100818 | CVE | Third Party AdvisoryVDB Entry |
| http://www.securitytracker.com/id/1039348 | CVE | Third Party AdvisoryVDB Entry |
| http://xenbits.xen.org/xsa/advisory-231.html | CVE | PatchVendor Advisory |
| https://lists.debian.org/debian-lts-announce/2018/10/msg00009.html | [email protected] | |
| https://support.citrix.com/article/CTX227185 | [email protected] | |
| https://www.debian.org/security/2017/dsa-4050 | [email protected] | |
| http://www.securityfocus.com/bid/100818 | [email protected] | Third Party AdvisoryVDB Entry |
| http://www.securitytracker.com/id/1039348 | [email protected] | Third Party AdvisoryVDB Entry |
| http://xenbits.xen.org/xsa/advisory-231.html | [email protected] | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| xen xen | <= 4.9.0 |
CPE
Remediation
| |
Change History
10 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| May 13, 2026 | CVE Status Change | [email protected] |
| Nov 21, 2024 | CVE Modified | CVE |
| May 14, 2024 | CVE Modified | [email protected] |
| Oct 19, 2018 | CVE Modified | [email protected] |
| Nov 30, 2017 | CVE Modified | [email protected] |
| Nov 15, 2017 | CVE Modified | [email protected] |
| Sep 23, 2017 | Initial Analysis | [email protected] |
| Sep 16, 2017 | CVE Modified | [email protected] |
| Sep 15, 2017 | CVE Modified | [email protected] |