CVE-2016-7093
HighSummary
Xen versions 4.5.3, 4.6.3, and 4.7.x allow local HVM guest OS administrators to overwrite hypervisor memory, thereby gaining host OS privileges. The issue arises from mishandling of instruction pointer truncation during emulation.
Risk Assessment
The organization may be exposed to unauthorized access to the host operating system, potentially leading to serious security breaches and data loss.
Recommendation
It is recommended to upgrade to the latest version of Xen to mitigate this vulnerability and to monitor access to HVM guest systems.
Other vulnerabilities in Xen hypervisor
See all- CVE-2026-23558High
CVE-2026-23558 describes a race condition that occurs during the grant table version change from v2 to v1 in HVM or PVH guests. This issue may lead to some status pages being freed while their mappings are still being inserted into the guest's page tables.
- CVE-2017-15595High
An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to cause a denial of service (unbounded recursion, stack consumption, and hypervisor crash) or possibly gain privileges via crafted page-table stacking.
- CVE-2017-15594High
An issue was discovered in Xen through 4.9.x allowing x86 SVM PV guest OS users to cause a denial of service (hypervisor crash) or gain privileges because IDT settings are mishandled during CPU hotplugging.
- CVE-2017-15592High
An issue was discovered in Xen through 4.9.x allowing x86 HVM guest OS users to cause a denial of service (hypervisor crash) or possibly gain privileges because self-linear shadow mappings are mishandled for translated guests.
- CVE-2017-15590High
An issue was discovered in Xen through 4.9.x allowing x86 guest OS users to cause a denial of service (hypervisor crash) or possibly gain privileges because MSI mapping was mishandled.
- CVE-2017-15588High
An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to execute arbitrary code on the host OS because of a race condition that can cause a stale TLB entry.
- CVE-2017-14319High
A grant unmapping issue was discovered in Xen through 4.9.x. When removing or replacing a grant mapping, the x86 PV specific path needs to ensure page table entries remain in sync with other accounting done.
- CVE-2017-12137High
In the x86 architecture of Xen, a vulnerability allows local PV guest OS users to gain host privileges via vectors related to map_grant_ref.
- CVE-2017-10916High
The vCPU context-switch implementation in Xen through 4.8.x improperly interacts with the Memory Protection Extensions (MPX) and Protection Key (PKU) features, making it easier for guest OS users to defeat ASLR and other protection mechanisms.
- CVE-2017-8904High
Xen through 4.8.x mishandles the 'contains segment descriptors' property during GNTTABOP_transfer operations, which might allow PV guest OS users to execute arbitrary code on the host OS.
Original NVD description (English source)
Xen 4.5.3, 4.6.3, and 4.7.x allow local HVM guest OS administrators to overwrite hypervisor memory and consequently gain host OS privileges by leveraging mishandling of instruction pointer truncation during emulation.