CVE-2017-14317

MediumCVSS 5.6/10Last modified Jun 17, 2026

Description

A domain cleanup issue was discovered in the C xenstore daemon (aka cxenstored) in Xen through 4.9.x. When shutting down a VM with a stubdomain, a race in cxenstored may cause a double-free. The xenstored daemon may crash, resulting in a DoS of any parts of the system relying on it (including domain creation / destruction, ballooning, device changes, etc.).

Metrics

CVSS 3.0 5.6/10CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H

Weakness enumeration

CWE-362

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/100826Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039350Third Party Advisory, VDB Entry
http://xenbits.xen.org/xsa/advisory-233.htmlPatch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2018/10/msg00009.html
https://www.debian.org/security/2017/dsa-4050
http://www.securityfocus.com/bid/100826Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039350Third Party Advisory, VDB Entry
http://xenbits.xen.org/xsa/advisory-233.htmlPatch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2018/10/msg00009.html
https://www.debian.org/security/2017/dsa-4050

Timeline

Published: Sep 12, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-143186.5An issue was discovered in Xen 4.5.x through 4.9.x. The function `__gnttab_cache_flush` handles GNTTABOP_cache_flush grant table operations.CVE-2017-143198.8A grant unmapping issue was discovered in Xen through 4.9.x. When removing or replacing a grant mapping, the x86 PV specific path needs to m CVE-2017-143208.0Mirasvit Helpdesk MX before 1.5.3 might allow remote attackers to execute arbitrary code by leveraging failure to filter uploaded files.CVE-2017-143215.4Multiple cross-site scripting (XSS) vulnerabilities in the administrative interface in Mirasvit Helpdesk MX before 1.5.3 allow remote attack CVE-2017-143229.8The function in charge to check whether the user is already logged in init.php in Interspire Email Marketer (IEM) prior to 6.1.6 allows remo CVE-2017-143239.8SSRF (Server Side Request Forgery) in getRemoteImage.php in Ueditor in Onethink V1.0 and V1.1 allows remote attackers to obtain sensitive in CVE-2017-143246.5In ImageMagick 7.0.7-1 Q16, a memory leak vulnerability was found in the function ReadMPCImage in coders/mpc.c, which allows attackers to ca CVE-2017-143256.5In ImageMagick 7.0.7-1 Q16, a memory leak vulnerability was found in the function PersistPixelCache in magick/cache.c, which allows attacker CVE-2017-143266.5In ImageMagick 7.0.7-1 Q16, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c, which allows attackers to ca CVE-2017-143274.4Extreme EXOS 16.x, 21.x, and 22.x allows administrators to read arbitrary files.CVE-2017-143287.5Extreme EXOS 15.7, 16.x, 21.x, and 22.x allows remote attackers to trigger a buffer overflow leading to a reboot.CVE-2017-143296.7Extreme EXOS 16.x, 21.x, and 22.x allows administrators to obtain a root shell via vectors involving an exsh debug shell.