CVE-2017-7228
HighSummary
An issue (known as XSA-212) was discovered in Xen, affecting versions 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix introduced an insufficient check on XENMEM_exchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arrays.
Risk Assessment
This vulnerability may lead to unauthorized access to hypervisor memory, posing a serious threat to the security of the entire virtualization system.
Recommendation
It is recommended to update to the latest version of Xen to patch this vulnerability and conduct a security audit of the system.
Other vulnerabilities in Xen hypervisor
See all- CVE-2026-23558High
CVE-2026-23558 describes a race condition that occurs during the grant table version change from v2 to v1 in HVM or PVH guests. This issue may lead to some status pages being freed while their mappings are still being inserted into the guest's page tables.
- CVE-2017-15595High
An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to cause a denial of service (unbounded recursion, stack consumption, and hypervisor crash) or possibly gain privileges via crafted page-table stacking.
- CVE-2017-15594High
An issue was discovered in Xen through 4.9.x allowing x86 SVM PV guest OS users to cause a denial of service (hypervisor crash) or gain privileges because IDT settings are mishandled during CPU hotplugging.
- CVE-2017-15592High
An issue was discovered in Xen through 4.9.x allowing x86 HVM guest OS users to cause a denial of service (hypervisor crash) or possibly gain privileges because self-linear shadow mappings are mishandled for translated guests.
- CVE-2017-15590High
An issue was discovered in Xen through 4.9.x allowing x86 guest OS users to cause a denial of service (hypervisor crash) or possibly gain privileges because MSI mapping was mishandled.
- CVE-2017-15588High
An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to execute arbitrary code on the host OS because of a race condition that can cause a stale TLB entry.
- CVE-2017-14319High
A grant unmapping issue was discovered in Xen through 4.9.x. When removing or replacing a grant mapping, the x86 PV specific path needs to ensure page table entries remain in sync with other accounting done.
- CVE-2017-12137High
In the x86 architecture of Xen, a vulnerability allows local PV guest OS users to gain host privileges via vectors related to map_grant_ref.
- CVE-2017-10916High
The vCPU context-switch implementation in Xen through 4.8.x improperly interacts with the Memory Protection Extensions (MPX) and Protection Key (PKU) features, making it easier for guest OS users to defeat ASLR and other protection mechanisms.
- CVE-2017-8904High
Xen through 4.8.x mishandles the 'contains segment descriptors' property during GNTTABOP_transfer operations, which might allow PV guest OS users to execute arbitrary code on the host OS.
Original NVD description (English source)
An issue (known as XSA-212) was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix introduced an insufficient check on XENMEM_exchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arrays.