CVE-2017-14431

Severity: medium (CVSS 5.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-09-13 · updated 2026-06-17
Weakness: CWE-772

Description

Memory leak in Xen 3.3 through 4.8.x allows guest OS users to cause a denial of service (ARM or x86 AMD host OS memory consumption) by continually rebooting, because certain cleanup is skipped if no pass-through device was ever assigned, aka XSA-207.

Affected products

xen: 3.3.0, 3.3.1, 3.3.2, 3.4.0, 3.4.1, 3.4.2 (+45)

References

https://lists.debian.org/debian-lts-announce/2018/09/msg00006.html
https://xenbits.xen.org/xsa/advisory-207.html
https://lists.debian.org/debian-lts-announce/2018/09/msg00006.html
https://xenbits.xen.org/xsa/advisory-207.html

Get alerted when CVE-2017-14431 or the next vulnerability affects your stack