CVE-2017-8903
published 2017-05-11CVE-2017-8903: Xen through 4.8.x on 64-bit platforms mishandles page tables after an IRET hypercall, which might allow PV guest OS users to execute arbitrary code on the host…
PriorityP344high8.8CVSS 3.0
AVLACLPRLUINSCCHIHAH
EPSS
0.49%
38.9th percentile
Xen through 4.8.x on 64-bit platforms mishandles page tables after an IRET hypercall, which might allow PV guest OS users to execute arbitrary code on the host OS, aka XSA-213.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | xen | < xen 4.8.1-1+deb9u1 (bookworm) | xen 4.8.1-1+deb9u1 (bookworm) |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | >= 0 < 4.8.1-1+deb9u1 | 4.8.1-1+deb9u1 |
| xen | xen | >= 0 < 4.8.1-1+deb9u1 | 4.8.1-1+deb9u1 |
| xen | xen | >= 0 < 4.8.1-1+deb9u1 | 4.8.1-1+deb9u1 |
| xen | xen | >= 0 < 4.8.1-1+deb9u1 | 4.8.1-1+deb9u1 |
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
osv8.8HIGH
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-qx4f-g697-2347: Xen through 4
ghsa_unreviewed·2022-05-13
CVE-2017-8903 [HIGH] GHSA-qx4f-g697-2347: Xen through 4
Xen through 4.8.x on 64-bit platforms mishandles page tables after an IRET hypercall, which might allow PV guest OS users to execute arbitrary code on the host OS, aka XSA-213.
OSV
CVE-2017-8903: Xen through 4
osv·2017-05-11·CVSS 8.8
CVE-2017-8903 [HIGH] CVE-2017-8903: Xen through 4
Xen through 4.8.x on 64-bit platforms mishandles page tables after an IRET hypercall, which might allow PV guest OS users to execute arbitrary code on the host OS, aka XSA-213.
Red Hat
xen: x86: 64bit PV guest breakout via pagetable use-after-mode-change (XSA-213)
vendor_redhat·2017-05-02·CVSS 8.8
CVE-2017-8903 [HIGH] xen: x86: 64bit PV guest breakout via pagetable use-after-mode-change (XSA-213)
xen: x86: 64bit PV guest breakout via pagetable use-after-mode-change (XSA-213)
Xen through 4.8.x on 64-bit platforms mishandles page tables after an IRET hypercall, which might allow PV guest OS users to execute arbitrary code on the host OS, aka XSA-213.
Package: xen (Red Hat Enterprise Linux 5) - Will not fix
Debian
CVE-2017-8903: xen - Xen through 4.8.x on 64-bit platforms mishandles page tables after an IRET hyper...
vendor_debian·2017·CVSS 8.8
CVE-2017-8903 [HIGH] CVE-2017-8903: xen - Xen through 4.8.x on 64-bit platforms mishandles page tables after an IRET hyper...
Xen through 4.8.x on 64-bit platforms mishandles page tables after an IRET hypercall, which might allow PV guest OS users to execute arbitrary code on the host OS, aka XSA-213.
Scope: local
bookworm: resolved (fixed in 4.8.1-1+deb9u1)
bullseye: resolved (fixed in 4.8.1-1+deb9u1)
forky: resolved (fixed in 4.8.1-1+deb9u1)
sid: resolved (fixed in 4.8.1-1+deb9u1)
trixie: resolved (fixed in 4.8.1-1+deb9u1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2017-8903 CVE-2017-8904 CVE-2017-8905 xen: various flaws [fedora-all]
bugzilla·2017-05-02·CVSS 8.8
CVE-2017-8903 [HIGH] CVE-2017-8903 CVE-2017-8904 CVE-2017-8905 xen: various flaws [fedora-all]
CVE-2017-8903 CVE-2017-8904 CVE-2017-8905 xen: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of
Bugzilla
CVE-2017-8903 xsa213 xen: x86: 64bit PV guest breakout via pagetable use-after-mode-change (XSA-213)
bugzilla·2017-04-18·CVSS 8.8
CVE-2017-8903 [HIGH] CVE-2017-8903 xsa213 xen: x86: 64bit PV guest breakout via pagetable use-after-mode-change (XSA-213)
CVE-2017-8903 xsa213 xen: x86: 64bit PV guest breakout via pagetable use-after-mode-change (XSA-213)
ISSUE DESCRIPTION
64-bit PV guests typically use separate (root) page tables for their
kernel and user modes. Hypercalls are accessible to guest kernel
context only, which certain hypercall handlers make assumptions on.
The IRET hypercall (replacing the identically name CPU instruction)
is used by guest kernels to transfer control from kernel mode to user
mode. If such an IRET hypercall is placed in the middle of a multicall
batch, subsequent operations invoked by the same multicall batch may
wrongly assume the guest to still be in kernel mode. If one or more of
these subsequent operations involve operations on page tables, they may
be using the wrong root page table, confusing internal a
http://www.securityfocus.com/bid/98426http://www.securitytracker.com/id/1038386https://blog.xenproject.org/2017/05/02/updates-on-xsa-213-xsa-214-and-xsa-215/https://security.gentoo.org/glsa/201705-11https://xenbits.xen.org/xsa/advisory-213.htmlhttp://www.securityfocus.com/bid/98426http://www.securitytracker.com/id/1038386https://blog.xenproject.org/2017/05/02/updates-on-xsa-213-xsa-214-and-xsa-215/https://security.gentoo.org/glsa/201705-11https://xenbits.xen.org/xsa/advisory-213.html
2017-05-11
Published