Every CVE Search/ Get API key

CVE-2017-7228

An issue (known as XSA-212) was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x,...

8.2 HighPublic exploitFix available

An issue (known as XSA-212) was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix introduced an insufficient check on XENMEM_exchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arrays.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.57%Down 6.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 8.2

An issue (known as XSA-212) was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix introduced an insufficient check on XENMEM_exchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arrays.

Record
CVE-2017-7228
CVSS 3.0
8.2 HighCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS 2.0
7.2 HighAV:L/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-129
Updated
2026-11-02
CVE List No score

An issue (known as XSA-212) was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix introduced an insufficient check on XENMEM_exchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arrays.

Record
CVE-2017-7228
Updated
2026-11-02
EUVDEUVD-2017-16263 No score

An issue (known as XSA-212) was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix introduced an insufficient check on XENMEM_exchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arrays.

Record
EUVD-2017-16263
Updated
2026-11-03
GitHub AdvisoriesGHSA-xm77-6vqw-642h 8.2

An issue (known as XSA-212) was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x,...

An issue (known as XSA-212) was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix introduced an insufficient check on XENMEM_exchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arrays.

Record
GHSA-xm77-6vqw-642h
CVSS 3.0
8.2 HighCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-129
Updated
2026-11-02
OSVALPINE-CVE-2017-7228 8.2

An issue (known as XSA-212) was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix introduced an insufficient check on XENMEM_exchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arrays.

Record
ALPINE-CVE-2017-7228
CVSS 3.0
8.2 HighCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSV 8.2

An issue (known as XSA-212) was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix introduced an insufficient check on XENMEM_exchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arrays.

Record
CVE-2017-7228
CVSS 3.0
8.2 HighCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVDEBIAN-CVE-2017-7228 8.2

An issue (known as XSA-212) was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix introduced an insufficient check on XENMEM_exchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arrays.

Record
DEBIAN-CVE-2017-7228
CVSS 3.0
8.2 HighCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2017-7228 8.2

An issue (known as XSA-212) was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix introduced an insufficient check on XENMEM_exchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arrays.

Record
UBUNTU-CVE-2017-7228
CVSS 3.0
8.2 HighCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVSUSE-SU-2017:0983-1 No score

Security update for xen

This update for xen to version 4.7.2 fixes the following issues:

These security issues were fixed:

  • CVE-2017-7228: Broken check in memory_exchange() permited PV guest breakout (bsc#1030442).
  • XSA-206: Unprivileged guests issuing writes to xenstore were able to stall progress of the control domain or driver domain, possibly leading to a Denial of Service (DoS) of the entire host (bsc#1030144).
  • CVE-2017-6505: The ohci_service_ed_list function in hw/usb/hcd-ohci.c allowed local guest OS users to cause a denial of service (infinite loop) via vectors involving the number of link endpoint list descriptors (bsc#1028235).

These non-security issues were fixed:

  • bsc#1015348: libvirtd didn't not start during boot
  • bsc#1014136: kdump couldn't dump a kernel on SLES12-SP2 with Xen hypervisor.
  • bsc#1026236: Fixed paravirtualized performance
  • bsc#1022555: Timeout in 'execution of /etc/xen/scripts/block add'
  • bsc#1029827: Forward port xenstored
  • bsc#1029128: Make xen to really produce xen.efi with gcc48
Record
SUSE-SU-2017:0983-1
Updated
2026-11-02
OSVSUSE-SU-2017:1058-1 No score

Security update for xen

This update for xen fixes the following security issues:

  • CVE-2017-7228: Broken check in memory_exchange() permited PV guest breakout (bsc#1030442).
  • CVE-2017-6414: Memory leak in the vcard_apdu_new function in card_7816.c in libcacard allowed local guest OS users to cause a denial of service (host memory consumption) via vectors related to allocating a new APDU object (bsc#1027570).
  • CVE-2017-6505: The ohci_service_ed_list function in hw/usb/hcd-ohci.c allowed local guest OS users to cause a denial of service (infinite loop) via vectors involving the number of link endpoint list descriptors (bsc#1028235).
Record
SUSE-SU-2017:1058-1
Updated
2026-11-02
OSVSUSE-SU-2017:1080-1 No score

Security update for xen

This update for xen fixes the following issues:

These security issues were fixed:

  • CVE-2017-7228: Broken check in memory_exchange() permited PV guest breakout (bsc#1030442).
  • XSA-206: Unprivileged guests issuing writes to xenstore were able to stall progress of the control domain or driver domain, possibly leading to a Denial of Service (DoS) of the entire host (bsc#1030144).
  • CVE-2017-6505: The ohci_service_ed_list function in hw/usb/hcd-ohci.c allowed local guest OS users to cause a denial of service (infinite loop) via vectors involving the number of link endpoint list descriptors (bsc#1028235).
  • CVE-2017-6414: Memory leak in the vcard_apdu_new function in card_7816.c in libcacard allowed local guest OS users to cause a denial of service (host memory consumption) via vectors related to allocating a new APDU object (bsc#1027570).
  • CVE-2017-2633: The VNC display driver support was vulnerable to an out-of-bounds memory access issue. A user/process inside guest could use this flaw to cause DoS (bsc#1026636).
  • CVE-2016-9603: A privileged user within the guest VM can cause a heap overflow in the device model process, potentially escalating their privileges to that of the device model process (bsc#1028655).

These non-security issues were fixed:

  • bsc#1022555: Timeout in 'execution of /etc/xen/scripts/block add'
  • bsc#1029827: Forward port xenstored
Record
SUSE-SU-2017:1080-1
Updated
2026-11-02
OSVSUSE-SU-2017:1081-1 No score

Security update for xen

This update for xen fixes the following issues:

These security issues were fixed:

  • CVE-2017-7228: Broken check in memory_exchange() permited PV guest breakout (bsc#1030442).
  • XSA-206: Unprivileged guests issuing writes to xenstore were able to stall progress of the control domain or driver domain, possibly leading to a Denial of Service (DoS) of the entire host (bsc#1030144).
  • CVE-2016-9603: A privileged user within the guest VM can cause a heap overflow in the device model process, potentially escalating their privileges to that of the device model process (bsc#1028655).
  • CVE-2017-6414: Memory leak in the vcard_apdu_new function in card_7816.c in libcacard allowed local guest OS users to cause a denial of service (host memory consumption) via vectors related to allocating a new APDU object (bsc#1027570).
  • CVE-2017-6505: The ohci_service_ed_list function in hw/usb/hcd-ohci.c allowed local guest OS users to cause a denial of service (infinite loop) via vectors involving the number of link endpoint list descriptors (bsc#1028235).
  • CVE-2017-2633: The VNC display driver support was vulnerable to an out-of-bounds memory access issue. A user/process inside guest could use this flaw to cause DoS (bsc#1026636).

These non-security issues were fixed:

  • bsc#1022555: Timeout in 'execution of /etc/xen/scripts/block add'
  • bsc#1029827: Forward port xenstored
Record
SUSE-SU-2017:1081-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
xen
Alpine:v3.10
 before 4.7.2-r0
4.7.2-r0
xen
Alpine:v3.11
 before 4.7.2-r0
4.7.2-r0
xen
Alpine:v3.12
 before 4.7.2-r0
4.7.2-r0
xen
Alpine:v3.13
 before 4.7.2-r0
4.7.2-r0
xen
Alpine:v3.14
 before 4.7.2-r0
4.7.2-r0
xen
Alpine:v3.15
 before 4.7.2-r0
4.7.2-r0
xen
Alpine:v3.16
 before 4.7.2-r0
4.7.2-r0
xen
Alpine:v3.17
 before 4.7.2-r0
4.7.2-r0
xen
Alpine:v3.18
 before 4.7.2-r0
4.7.2-r0
xen
Alpine:v3.19
 before 4.7.2-r0
4.7.2-r0
Show 32 moreShow less
Affected packages
PackageAffectedFixed
xen
Alpine:v3.20
 before 4.7.2-r0
4.7.2-r0
xen
Alpine:v3.21
 before 4.7.2-r0
4.7.2-r0
xen
Alpine:v3.22
 before 4.7.2-r0
4.7.2-r0
xen
Alpine:v3.23
 before 4.7.2-r0
4.7.2-r0
xen
Alpine:v3.24
 before 4.7.2-r0
4.7.2-r0
xen
Alpine:v3.4
 before 4.6.3-r8
4.6.3-r8
xen
Alpine:v3.5
 before 4.7.2-r0
4.7.2-r0
xen
Alpine:v3.6
 before 4.7.2-r0
4.7.2-r0
xen
Alpine:v3.7
 before 4.7.2-r0
4.7.2-r0
xen
Alpine:v3.8
 before 4.7.2-r0
4.7.2-r0
xen
Alpine:v3.9
 before 4.7.2-r0
4.7.2-r0
xen
Debian:12
 before 4.8.1-1
4.8.1-1
xen
Debian:13
 before 4.8.1-1
4.8.1-1
xen
Debian:14
 before 4.8.1-1
4.8.1-1
xen
Debian:7
 before 4.1.6.lts1-6, plus listed versions
4.1.4-34.1.4-3+deb7u14.1.4-3+deb7u24.1.4-3+deb7u34.1.4-3+deb7u4
Show 12 moreShow less
4.1.4-3+deb7u54.1.4-3+deb7u64.1.4-3+deb7u74.1.4-3+deb7u84.1.4-3+deb7u94.1.4-44.1.6.1-1+deb7u14.1.6.lts1-14.1.6.lts1-24.1.6.lts1-34.1.6.lts1-44.1.6.lts1-5
4.1.6.lts1-6
xen
Debian:8
From an advisory covering 7 CVEs
 before 4.4.1-9+deb8u9, plus listed versions
4.4.1-94.4.1-9+deb8u14.4.1-9+deb8u24.4.1-9+deb8u34.4.1-9+deb8u4
Show 4 moreShow less
4.4.1-9+deb8u54.4.1-9+deb8u64.4.1-9+deb8u74.4.1-9+deb8u8
4.4.1-9+deb8u9
xen
SUSE:Linux Enterprise Desktop 12 SP2
From an advisory covering 2 CVEs
 before 4.7.2_02-36.1
4.7.2_02-36.1
xen
SUSE:Linux Enterprise Software Development Kit 12 SP2
From an advisory covering 2 CVEs
 before 4.7.2_02-36.1
4.7.2_02-36.1
xen
SUSE:Linux Enterprise Server 12 SP2
From an advisory covering 2 CVEs
 before 4.7.2_02-36.1
4.7.2_02-36.1
xen
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
From an advisory covering 2 CVEs
 before 4.7.2_02-36.1
4.7.2_02-36.1
xen
SUSE:OpenStack Cloud 5
From an advisory covering 3 CVEs
 before 4.2.5_21-38.1
4.2.5_21-38.1
xen
SUSE:Manager 2.1
From an advisory covering 3 CVEs
 before 4.2.5_21-38.1
4.2.5_21-38.1
xen
SUSE:Manager Proxy 2.1
From an advisory covering 3 CVEs
 before 4.2.5_21-38.1
4.2.5_21-38.1
xen
SUSE:Linux Enterprise Point of Sale 11 SP3
From an advisory covering 3 CVEs
 before 4.2.5_21-38.1
4.2.5_21-38.1
xen
SUSE:Linux Enterprise Server 11 SP3-LTSS
From an advisory covering 3 CVEs
 before 4.2.5_21-38.1
4.2.5_21-38.1
xen
SUSE:Linux Enterprise Server for SAP Applications 12
From an advisory covering 5 CVEs
 before 4.4.4_16-22.36.1
4.4.4_16-22.36.1
xen
SUSE:Linux Enterprise Server 12-LTSS
From an advisory covering 5 CVEs
 before 4.4.4_16-22.36.1
4.4.4_16-22.36.1
xen
SUSE:Linux Enterprise Software Development Kit 11 SP4
From an advisory covering 5 CVEs
 before 4.4.4_16-54.1
4.4.4_16-54.1
xen
SUSE:Linux Enterprise Server 11 SP4
From an advisory covering 5 CVEs
 before 4.4.4_16-54.1
4.4.4_16-54.1
xen
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
From an advisory covering 5 CVEs
 before 4.4.4_16-54.1
4.4.4_16-54.1
xen
Ubuntu:14.04:LTS
 before 4.4.2-0ubuntu0.14.04.11, plus listed versions
4.3.0-1ubuntu14.3.0-1ubuntu24.3.0-1ubuntu34.3.0-1ubuntu44.3.0-1ubuntu5
Show 20 moreShow less
4.4.0-0ubuntu34.4.0-0ubuntu44.4.0-0ubuntu54.4.0-0ubuntu5.14.4.0-0ubuntu5.24.4.1-0ubuntu0.14.04.14.4.1-0ubuntu0.14.04.24.4.1-0ubuntu0.14.04.34.4.1-0ubuntu0.14.04.44.4.1-0ubuntu0.14.04.54.4.1-0ubuntu0.14.04.64.4.2-0ubuntu0.14.04.14.4.2-0ubuntu0.14.04.24.4.2-0ubuntu0.14.04.34.4.2-0ubuntu0.14.04.44.4.2-0ubuntu0.14.04.54.4.2-0ubuntu0.14.04.64.4.2-0ubuntu0.14.04.74.4.2-0ubuntu0.14.04.94.4.2-0ubuntu0.14.04.10
4.4.2-0ubuntu0.14.04.11
xen
Ubuntu:16.04:LTS
 before 4.6.5-0ubuntu1.1, plus listed versions
4.5.1-0ubuntu14.5.1-0ubuntu24.6.0-1ubuntu14.6.0-1ubuntu24.6.0-1ubuntu4
Show 4 moreShow less
4.6.0-1ubuntu4.14.6.0-1ubuntu4.24.6.0-1ubuntu4.34.6.5-0ubuntu1
4.6.5-0ubuntu1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBXen - Broken Check in 'memory_exchange()' Permits PV Guest Breakout2017-04-11

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-7228 is a high vulnerability (CVSS 8.2) in Xen, published April 4, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.57%, the 75th percentile. Fixed in xen 4.7.2-r0.

References

Show 30 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open