CVE-2017-8904
HighSummary
Xen through 4.8.x mishandles the 'contains segment descriptors' property during GNTTABOP_transfer operations, which might allow PV guest OS users to execute arbitrary code on the host OS.
Risk Assessment
This vulnerability could lead to guest users gaining control over the host system, posing a significant security risk to the organization.
Recommendation
It is recommended to upgrade to the latest version of Xen to mitigate this vulnerability and to monitor systems for potential exploitation attempts.
Other vulnerabilities in Xen hypervisor
See all- CVE-2026-23558High
CVE-2026-23558 describes a race condition that occurs during the grant table version change from v2 to v1 in HVM or PVH guests. This issue may lead to some status pages being freed while their mappings are still being inserted into the guest's page tables.
- CVE-2017-15595High
An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to cause a denial of service (unbounded recursion, stack consumption, and hypervisor crash) or possibly gain privileges via crafted page-table stacking.
- CVE-2017-15594High
An issue was discovered in Xen through 4.9.x allowing x86 SVM PV guest OS users to cause a denial of service (hypervisor crash) or gain privileges because IDT settings are mishandled during CPU hotplugging.
- CVE-2017-15592High
An issue was discovered in Xen through 4.9.x allowing x86 HVM guest OS users to cause a denial of service (hypervisor crash) or possibly gain privileges because self-linear shadow mappings are mishandled for translated guests.
- CVE-2017-15590High
An issue was discovered in Xen through 4.9.x allowing x86 guest OS users to cause a denial of service (hypervisor crash) or possibly gain privileges because MSI mapping was mishandled.
- CVE-2017-15588High
An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to execute arbitrary code on the host OS because of a race condition that can cause a stale TLB entry.
- CVE-2017-14319High
A grant unmapping issue was discovered in Xen through 4.9.x. When removing or replacing a grant mapping, the x86 PV specific path needs to ensure page table entries remain in sync with other accounting done.
- CVE-2017-12137High
In the x86 architecture of Xen, a vulnerability allows local PV guest OS users to gain host privileges via vectors related to map_grant_ref.
- CVE-2017-10916High
The vCPU context-switch implementation in Xen through 4.8.x improperly interacts with the Memory Protection Extensions (MPX) and Protection Key (PKU) features, making it easier for guest OS users to defeat ASLR and other protection mechanisms.
- CVE-2017-8903High
Xen versions up to 4.8.x on 64-bit platforms mishandle page tables after an IRET hypercall, which might allow PV guest OS users to execute arbitrary code on the host OS.
Original NVD description (English source)
Xen through 4.8.x mishandles the "contains segment descriptors" property during GNTTABOP_transfer (aka guest transfer) operations, which might allow PV guest OS users to execute arbitrary code on the host OS, aka XSA-214.