CVE-2017-8905

Description

Xen through 4.6.x on 64-bit platforms mishandles a failsafe callback, which might allow PV guest OS users to execute arbitrary code on the host OS, aka XSA-215.

CVSS Metrics

• v3.0•HIGH•Score: 8.8CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
• v2.0•MEDIUM•Score: 6.8AV:L/AC:L/Au:S/C:C/I:C/A:C

EPSS Trends

Current EPSS score: 0.09%• Percentile: 25%

Techniques & Countermeasures

• CWE-682•Incorrect Calculation

  The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.

Affected Systems

• xen•xen

  4.6.0 | 4.6.1 | 4.6.2 | 4.6.3 | 4.6.4 | 4.6.5

References (5)

• https://security.gentoo.org/glsa/201705-11
• http://www.securitytracker.com/id/1038388
• https://xenbits.xen.org/xsa/advisory-215.html
• http://www.securityfocus.com/bid/98436
• https://blog.xenproject.org/2017/05/02/updates-on-xsa-213-xsa-214-and-xsa-215/