CVE-2017-8905: High severity xen xapi vulnerability
Published May 11, 2017
·Updated
Xen through 4.6.x on 64-bit platforms mishandles a failsafe callback, which might allow PV guest OS users to execute arbitrary code on the host OS, aka XSA-215.
Affected Software
6 affected components
XEN Xen=4.6.0
XEN Xen=4.6.1
XEN Xen=4.6.2
XEN Xen=4.6.3
XEN Xen=4.6.4
XEN Xen=4.6.5
Remediation
Patch Available
Event History
May 11, 2017
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-8905?
CVE-2017-8905 has been assigned a high severity rating due to its potential to allow arbitrary code execution on the host OS.
2
How do I fix CVE-2017-8905?
To fix CVE-2017-8905, you should upgrade to Xen versions 4.6.6 or later, where the vulnerability has been addressed.
3
What platforms are affected by CVE-2017-8905?
CVE-2017-8905 affects Xen through versions 4.6.x on 64-bit platforms.
4
What types of attacks can be executed due to CVE-2017-8905?
CVE-2017-8905 can allow PV guest OS users to execute arbitrary code on the host OS, leading to potential system compromise.
5
Is CVE-2017-8905 related to any specific Xen architecture?
CVE-2017-8905 is specifically related to the Xen hypervisor's mishandling of a failsafe callback within the paravirtualized (PV) architecture.