CVE-2017-8905
published 2017-05-11CVE-2017-8905: Xen through 4.6.x on 64-bit platforms mishandles a failsafe callback, which might allow PV guest OS users to execute arbitrary code on the host OS, aka XSA-215.
PriorityP344high8.8CVSS 3.0
AVLACLPRLUINSCCHIHAH
EPSS
0.42%
34.2th percentile
Xen through 4.6.x on 64-bit platforms mishandles a failsafe callback, which might allow PV guest OS users to execute arbitrary code on the host OS, aka XSA-215.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | xen | < xen 4.8.0~rc3-1 (bookworm) | xen 4.8.0~rc3-1 (bookworm) |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | — | — |
| xen | xen | >= 0 < 4.8.0~rc3-1 | 4.8.0~rc3-1 |
| xen | xen | >= 0 < 4.8.0~rc3-1 | 4.8.0~rc3-1 |
| xen | xen | >= 0 < 4.8.0~rc3-1 | 4.8.0~rc3-1 |
| xen | xen | >= 0 < 4.8.0~rc3-1 | 4.8.0~rc3-1 |
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:L/AC:L/Au:S/C:C/I:C/A:C
osv8.8HIGH
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
xen: possible memory corruption via failsafe callback (XSA-215)
vendor_redhat·2017-05-02·CVSS 8.8
CVE-2017-8905 [HIGH] xen: possible memory corruption via failsafe callback (XSA-215)
xen: possible memory corruption via failsafe callback (XSA-215)
Xen through 4.6.x on 64-bit platforms mishandles a failsafe callback, which might allow PV guest OS users to execute arbitrary code on the host OS, aka XSA-215.
Package: xen (Red Hat Enterprise Linux 5) - Will not fix
Debian
CVE-2017-8905: xen - Xen through 4.6.x on 64-bit platforms mishandles a failsafe callback, which migh...
vendor_debian·2017·CVSS 8.8
CVE-2017-8905 [HIGH] CVE-2017-8905: xen - Xen through 4.6.x on 64-bit platforms mishandles a failsafe callback, which migh...
Xen through 4.6.x on 64-bit platforms mishandles a failsafe callback, which might allow PV guest OS users to execute arbitrary code on the host OS, aka XSA-215.
Scope: local
bookworm: resolved (fixed in 4.8.0~rc3-1)
bullseye: resolved (fixed in 4.8.0~rc3-1)
forky: resolved (fixed in 4.8.0~rc3-1)
sid: resolved (fixed in 4.8.0~rc3-1)
trixie: resolved (fixed in 4.8.0~rc3-1)
GHSA
GHSA-fff9-ccrg-mjcr: Xen through 4
ghsa_unreviewed·2022-05-13
CVE-2017-8905 [HIGH] CWE-682 GHSA-fff9-ccrg-mjcr: Xen through 4
Xen through 4.6.x on 64-bit platforms mishandles a failsafe callback, which might allow PV guest OS users to execute arbitrary code on the host OS, aka XSA-215.
OSV
CVE-2017-8905: Xen through 4
osv·2017-05-11·CVSS 8.8
CVE-2017-8905 [HIGH] CVE-2017-8905: Xen through 4
Xen through 4.6.x on 64-bit platforms mishandles a failsafe callback, which might allow PV guest OS users to execute arbitrary code on the host OS, aka XSA-215.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2017-8903 CVE-2017-8904 CVE-2017-8905 xen: various flaws [fedora-all]
bugzilla·2017-05-02·CVSS 8.8
CVE-2017-8903 [HIGH] CVE-2017-8903 CVE-2017-8904 CVE-2017-8905 xen: various flaws [fedora-all]
CVE-2017-8903 CVE-2017-8904 CVE-2017-8905 xen: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of
Bugzilla
CVE-2017-8905 xsa215 xen: possible memory corruption via failsafe callback (XSA-215)
bugzilla·2017-04-18·CVSS 8.8
CVE-2017-8905 [HIGH] CVE-2017-8905 xsa215 xen: possible memory corruption via failsafe callback (XSA-215)
CVE-2017-8905 xsa215 xen: possible memory corruption via failsafe callback (XSA-215)
ISSUE DESCRIPTION
Under certain special conditions Xen reports an exception resulting
from returning to guest mode not via ordinary exception entry points,
but via a so call failsafe callback. This callback, unlike exception
handlers, takes 4 extra arguments on the stack (the saved data
selectors DS, ES, FS, and GS). Prior to placing exception or failsafe
callback frames on the guest kernel stack, Xen checks the linear
address range to not overlap with hypervisor space. The range spanned
by that check was mistakenly not covering these extra 4 slots.
IMPACT
A malicious or buggy 64-bit PV guest may be able to modify part of a
physical memory page not belonging to it, potentially allowing for all
of privi
http://www.securityfocus.com/bid/98436http://www.securitytracker.com/id/1038388https://blog.xenproject.org/2017/05/02/updates-on-xsa-213-xsa-214-and-xsa-215/https://security.gentoo.org/glsa/201705-11https://xenbits.xen.org/xsa/advisory-215.htmlhttp://www.securityfocus.com/bid/98436http://www.securitytracker.com/id/1038388https://blog.xenproject.org/2017/05/02/updates-on-xsa-213-xsa-214-and-xsa-215/https://security.gentoo.org/glsa/201705-11https://xenbits.xen.org/xsa/advisory-215.html
2017-05-11
Published