CVE-2017-8903

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Xen through 4.8.x on 64-bit platforms mishandles page tables after an IRET hypercall, which might allow PV guest OS users to execute arbitrary code on the host OS, aka XSA-213.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/98426
http://www.securitytracker.com/id/1038386
https://blog.xenproject.org/2017/05/02/updates-on-xsa-213-xsa-214-and-xsa-215/Vendor Advisory
https://security.gentoo.org/glsa/201705-11
https://xenbits.xen.org/xsa/advisory-213.htmlMitigation, Patch, Vendor Advisory
http://www.securityfocus.com/bid/98426
http://www.securitytracker.com/id/1038386
https://blog.xenproject.org/2017/05/02/updates-on-xsa-213-xsa-214-and-xsa-215/Vendor Advisory
https://security.gentoo.org/glsa/201705-11
https://xenbits.xen.org/xsa/advisory-213.htmlMitigation, Patch, Vendor Advisory

Timeline

Published: May 11, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-89048.8Xen through 4.8.x mishandles the "contains segment descriptors" property during GNTTABOP_transfer (aka guest transfer) operations, which mig CVE-2017-89058.8Xen through 4.6.x on 64-bit platforms mishandles a failsafe callback, which might allow PV guest OS users to execute arbitrary code on the h CVE-2017-89065.5An integer underflow vulnerability exists in pixel-a.asm, the x86 assembly code for planeClipAndMax() in MulticoreWare x265 through 2.4, as CVE-2017-89078.8Atlassian Bamboo 5.x before 5.15.7 and 6.x before 6.0.1 did not correctly check if a user creating a deployment project had the edit permiss CVE-2017-89085.5The mark_line_tr function in gxscanc.c in Artifex Ghostscript 9.21 allows remote attackers to cause a denial of service (out-of-bounds read)CVE-2017-89119.8An integer underflow has been identified in the unicode_to_utf8() function in tnef 1.4.14. This might lead to invalid write operations, cont CVE-2017-89127.2CMS Made Simple (CMSMS) 2.1.6 allows remote authenticated administrators to execute arbitrary PHP code via the code parameter to admin/editu CVE-2017-89138.8The Visual Composer VC70RUNTIME component in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE CVE-2017-89148.3sinopia, as used in SAP HANA XS 1.00 and 2.00, allows remote attackers to hijack npm packages or host arbitrary files by leveraging an insec CVE-2017-89157.5sinopia, as used in SAP HANA XS 1.00 and 2.00, allows remote attackers to cause a denial of service (assertion failure and service crash) by CVE-2017-89167.8In Center for Internet Security CIS-CAT Pro Dashboard before 1.0.4, an authenticated user is able to change an administrative user's e-mail CVE-2017-89179.8SQL injection vulnerability in Joomla! 3.7.x before 3.7.1 allows attackers to execute arbitrary SQL commands via unspecified vectors.