CVE-2017-10911

What it actually does

The make_response function copies uninitialized padding bytes from Xen block-interface response structures into buffers visible to guest kernels, exposing adjacent host or peer-guest kernel memory contents.

Why it matters to the business

Virtualized environments risk leakage of kernel memory across VM boundaries, potentially disclosing credentials, keys, or other confidential data stored in the host kernel and increasing the blast radius of any compromised guest.

How an attack unfolds

An attacker controlling a guest VM issues block I/O requests crafted to trigger response structures whose padding fields still contain residual kernel data; the guest then reads those responses to harvest the leaked host or sibling-guest memory.

How to fix it

Upgrade the Linux kernel to version 4.11.8 or later; apply commit 089bc0143f489bd3a4578bdff5f4ca68fb26f341 in the xen-blkback driver to zero padding fields before copying responses.

How to confirm the fix worked

Confirm the running kernel is at least 4.11.8; inspect blkback.c for the padding-clearing change present in commit 089bc0143f489bd3a4578bdff5f4ca68fb26f341; re-test with a synthetic block request that previously triggered leakage.

Typical attack path

1. Obtain code execution or shell access inside a Xen guest VM
2. Issue repeated block-device requests that exercise the blkback response path
3. Parse the returned response structures to extract uninitialized padding bytes
4. Reconstruct and exfiltrate sensitive host-kernel memory contents

How to detect it

Review Xen hypervisor and guest kernel logs for anomalous block-response sizes or repeated I/O patterns that could indicate padding leakage attempts; correlate with process activity inside guests that suddenly access large memory regions.

What your security team should do

• Apply the kernel update on all Xen hosts within the next maintenance window
• Audit guest VM isolation boundaries and limit block-device access where feasible
• Monitor for future Xen-related kernel advisories given the age and prevalence of the affected code