CVE-2017-15589

6.5 mediumEPSS 0.4%

Medium (6.5) in xen xen. EPSS 0.4% chance of exploitation in the next 30 days.

An issue was discovered in Xen through 4.9.x allowing x86 HVM guest OS users to obtain sensitive information from the host OS (or an arbitrary guest OS) because intercepted I/O operations can cause a write of data from uninitialized hypervisor stack memory.

Severity

CVSS 3.0

6.5 medium

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 35% of CVEs (scores of 2026-10-31)
CWE: CWE-200
Published: 2017-10-18
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

xen:xen

References

http://www.securityfocus.com/bid/101496
http://www.securitytracker.com/id/1039568
https://lists.debian.org/debian-lts-announce/2017/11/msg00027.html
https://lists.debian.org/debian-lts-announce/2018/10/msg00009.html
https://security.gentoo.org/glsa/201801-14

Check your stack JSON