Xen through 4.8.x mishandles the "contains segment descriptors" property during GNTTABOP_transfer (aka guest transfer) operations, which might allow PV guest OS users to execute arbitrary code on the host OS, aka XSA-214.
CVSS Details
- CVSS 3.0 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade xen | Aug 30, 2017 | May 11, 2017 |
| Debian | — | Upgrade xen | May 30, 2017 | May 11, 2017 |
| Gentoo Linux | — | Upgrade app-emulation/xen-pvgrub.Upgrade app-emulation/xen.Upgrade app-emulation/xen-tools. | Oct 30, 2017 | May 11, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 2, 2017 |
| Ubuntu | — | Upgrade xen | Nov 19, 2024 | May 11, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub