Skip to content
Fencer Intel
medium 6.5

CVE-2017-12855 json

Xen maintains the _GTF_{read,writ}ing bits as appropriate, to inform the guest that a grant is in use.

published 2017-08-15 9 y ago modified 2026-06-17 4 mo ago also EUVD-2017-4390

cvss
6.5
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 34%
public exploits
0
none known

Summary

Xen maintains the _GTF_{read,writ}ing bits as appropriate, to inform the guest that a grant is in use. A guest is expected not to modify the grant details while it is in use, whereas the guest is free to modify/reuse the grant entry when it is not in use. Under some circumstances, Xen will clear the status bits too early, incorrectly informing the guest that the grant is no longer in use. A guest may prematurely believe that a granted frame is safely private again, and reuse it in a way which contains sensitive information, while the domain on the far end of the grant is still using the grant. Xen 4.9, 4.8, 4.7, 4.6, and 4.5 are affected.

Patch / fix

  • xen Debian 14, Debian 13, Debian 12 4.8.1-1+deb9u3

debian advisories DEBIAN-CVE-2017-12855

  • xen Ubuntu 14.04 LTS 4.4.2-0ubuntu0.14.04.14
  • xen Ubuntu 16.04 LTS 4.6.5-0ubuntu1.4

ubuntu advisories UBUNTU-CVE-2017-12855

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • xen SLES 12 SP3, SLED 12 SP3, SLE Software Development Kit 12 SP3 +1 more 4.9.0_11-3.9.1
  • xen SLES for SAP 11 SP4, SLES 11 SP4, SLE Software Development Kit 11 SP4 4.4.4_22-61.9.2
  • xen SLES 11 SP3-LTSS, SLE Point of Sale 11 SP3 4.2.5_21-45.5.1
  • xen SLES for SAP 12 SP2, SLES 12 SP2, SLED 12 SP2 +1 more 4.7.3_03-43.9.1
  • xen SLES for SAP 12, SLES 12-LTSS 4.4.4_22-22.51.2

suse advisories SUSE-SU-2017:2327-2SUSE-SU-2017:2327-1SUSE-SU-2017:2541-1SUSE-SU-2017:2450-1SUSE-SU-2017:2339-1SUSE-SU-2017:2326-1

  • xen Alpine 3.24, Alpine 3.23, Alpine 3.22 +15 more 4.9.0-r1
  • xen Alpine 3.4, Alpine 3.3 4.6.6-r0
  • xen Alpine 3.5 4.7.3-r0
  • xen Alpine 3.6 4.8.2-r0

alpine advisories ALPINE-CVE-2017-12855

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2017-12855 updated cvss 4.7

xen: grant_table: possibly premature clearing of GTF_writing / GTF_reading (XSA-230)

  • Red Hat Enterprise Linux 5 xen
    affected: no fix planned “Will not fix”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.40% chance of exploitation in the next 30 days, higher than 34% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.0 6.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
NVD 2.0 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.