Privilege escalation in Xen - CVE-2017-8903

Vulnerability identifier: #VU6843

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-8903

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists due to an error in the GNTTABOP_transfer operation. A local attacker can use a specially crafted IRET hypercall, gain write access to kernel page tables and execute arbitrary code on the host OS with elevated privileges.

Successful exploitation of the vulnerability results in privilege escalation.

Xen
Gentoo Linux
Fedora
xen (Alpine package)
Gentoo app-emulation/xen
Gentoo app-emulation/xen-pvgrub
Gentoo app-emulation/xen-tools
xen

Install update from vendor's website.

xen (Alpine package) - update to 4.5.5-r2
xen - addressed in versions 4.6.5-6.fc24, 4.7.2-6.fc25, 4.8.1-2.fc26

• http://xenbits.xen.org/xsa/advisory-213.html

• Gentoo update for Xen
• Multiple vulnerabilities in Xen
• Privilege escalation in xen (Alpine package)
• Fedora 25 update for xen
• Fedora 26 update for xen
• Fedora 24 update for xen