{"id":"CVE-2017-7228","aliases":["ALPINE-CVE-2017-7228","DEBIAN-CVE-2017-7228","DLA-907-1","DSA-3847-1","EUVD-2017-16263","GHSA-xm77-6vqw-642h","SUSE-SU-2017:0983-1","SUSE-SU-2017:1058-1","SUSE-SU-2017:1080-1","SUSE-SU-2017:1081-1","UBUNTU-CVE-2017-7228"],"status":"published","title":"An issue (known as XSA-212) was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x,...","description":"An issue (known as XSA-212) was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix introduced an insufficient check on XENMEM_exchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arrays.","severity":{"version":"3.0","score":8.2,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01569,"percentile":0.75517,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-129"],"published":"2017-04-04T14:00:00Z","modified":"2026-09-01T20:03:49Z","exploits":[{"source":"exploitdb","id":"EDB-41870","title":"Xen - Broken Check in 'memory_exchange()' Permits PV Guest Breakout","type":"local","platform":"multiple","date":"2017-04-11","verified":true,"url":"https://www.exploit-db.com/exploits/41870"}],"fixes":[{"ecosystem":"Alpine:v3.10","package":"xen","fixed_in":["4.7.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"xen","fixed_in":["4.7.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"xen","fixed_in":["4.7.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"xen","fixed_in":["4.7.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"xen","fixed_in":["4.7.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"xen","fixed_in":["4.7.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"xen","fixed_in":["4.7.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"xen","fixed_in":["4.7.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"xen","fixed_in":["4.7.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"xen","fixed_in":["4.7.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"xen","fixed_in":["4.7.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"xen","fixed_in":["4.7.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"xen","fixed_in":["4.7.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"xen","fixed_in":["4.7.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"xen","fixed_in":["4.7.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.4","package":"xen","fixed_in":["4.6.3-r8"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"xen","fixed_in":["4.7.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"xen","fixed_in":["4.7.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"xen","fixed_in":["4.7.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"xen","fixed_in":["4.7.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"xen","fixed_in":["4.7.2-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"xen","fixed_in":["4.8.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xen","fixed_in":["4.8.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xen","fixed_in":["4.8.1-1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"xen","fixed_in":["4.1.6.lts1-6"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"xen","fixed_in":["4.4.2-0ubuntu0.14.04.11"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"xen","fixed_in":["4.6.5-0ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.3-r8"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.1-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.6.lts1-6"}]}],"versions":["4.1.4-3","4.1.4-3+deb7u1","4.1.4-3+deb7u2","4.1.4-3+deb7u3","4.1.4-3+deb7u4","4.1.4-3+deb7u5","4.1.4-3+deb7u6","4.1.4-3+deb7u7","4.1.4-3+deb7u8","4.1.4-3+deb7u9","4.1.4-4","4.1.6.1-1+deb7u1","4.1.6.lts1-1","4.1.6.lts1-2","4.1.6.lts1-3","4.1.6.lts1-4","4.1.6.lts1-5"]},{"source":"osv","ecosystem":"Debian:8","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.1-9+deb8u9"}]}],"versions":["4.4.1-9","4.4.1-9+deb8u1","4.4.1-9+deb8u2","4.4.1-9+deb8u3","4.4.1-9+deb8u4","4.4.1-9+deb8u5","4.4.1-9+deb8u6","4.4.1-9+deb8u7","4.4.1-9+deb8u8"],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2_02-36.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2_02-36.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2_02-36.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.2_02-36.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.5_21-38.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager 2.1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.5_21-38.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy 2.1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.5_21-38.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.5_21-38.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.5_21-38.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_16-22.36.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_16-22.36.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_16-54.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_16-54.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_16-54.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.2-0ubuntu0.14.04.11"}]}],"versions":["4.3.0-1ubuntu1","4.3.0-1ubuntu2","4.3.0-1ubuntu3","4.3.0-1ubuntu4","4.3.0-1ubuntu5","4.4.0-0ubuntu3","4.4.0-0ubuntu4","4.4.0-0ubuntu5","4.4.0-0ubuntu5.1","4.4.0-0ubuntu5.2","4.4.1-0ubuntu0.14.04.1","4.4.1-0ubuntu0.14.04.2","4.4.1-0ubuntu0.14.04.3","4.4.1-0ubuntu0.14.04.4","4.4.1-0ubuntu0.14.04.5","4.4.1-0ubuntu0.14.04.6","4.4.2-0ubuntu0.14.04.1","4.4.2-0ubuntu0.14.04.2","4.4.2-0ubuntu0.14.04.3","4.4.2-0ubuntu0.14.04.4","4.4.2-0ubuntu0.14.04.5","4.4.2-0ubuntu0.14.04.6","4.4.2-0ubuntu0.14.04.7","4.4.2-0ubuntu0.14.04.9","4.4.2-0ubuntu0.14.04.10"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.5-0ubuntu1.1"}]}],"versions":["4.5.1-0ubuntu1","4.5.1-0ubuntu2","4.6.0-1ubuntu1","4.6.0-1ubuntu2","4.6.0-1ubuntu4","4.6.0-1ubuntu4.1","4.6.0-1ubuntu4.2","4.6.0-1ubuntu4.3","4.6.5-0ubuntu1"]}],"products":[{"vendor":"xen","product":"xen"}],"references":[{"url":"http://www.securityfocus.com/bid/97375","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://xenbits.xen.org/xsa/advisory-212.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"http://openwall.com/lists/oss-security/2017/04/04/3","tags":["x_refsource_CONFIRM","x_transferred","Mailing List","Third Party Advisory","advisory","article","report"]},{"url":"https://github.com/QubesOS/qubes-secpack/blob/master/QSBs/qsb-029-2017.txt","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.debian.org/security/2017/dsa-3847","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"https://www.exploit-db.com/exploits/41870/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","web"]},{"url":"https://googleprojectzero.blogspot.com/2017/04/pandavirtualization-exploiting-xen.html","tags":["x_refsource_MISC","x_transferred","Technical Description","Third Party Advisory","advisory","article"]},{"url":"http://www.securitytracker.com/id/1038223","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-7228"},{"url":"https://www.exploit-db.com/exploits/41870"},{"url":"https://github.com/advisories/GHSA-xm77-6vqw-642h"},{"url":"https://security.alpinelinux.org/vuln/CVE-2017-7228","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-7228","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170983-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1014136","tags":["report"]},{"url":"https://bugzilla.suse.com/1015348","tags":["report"]},{"url":"https://bugzilla.suse.com/1022555","tags":["report"]},{"url":"https://bugzilla.suse.com/1026236","tags":["report"]},{"url":"https://bugzilla.suse.com/1027519","tags":["report"]},{"url":"https://bugzilla.suse.com/1028235","tags":["report"]},{"url":"https://bugzilla.suse.com/1029128","tags":["report"]},{"url":"https://bugzilla.suse.com/1029827","tags":["report"]},{"url":"https://bugzilla.suse.com/1030144","tags":["report"]},{"url":"https://bugzilla.suse.com/1030442","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7228","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171058-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1027570","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6414","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171080-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1026636","tags":["report"]},{"url":"https://bugzilla.suse.com/1028655","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2633","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171081-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-7228","tags":["report"]},{"url":"https://xenbits.xen.org/xsa/advisory-212.html","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-7228","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-7228","description":"An issue (known as XSA-212) was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix introduced an insufficient check on XENMEM_exchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arrays.","status":"published","published":"2017-04-04T14:00:00Z","modified":"2024-08-05T15:56:36.021Z","updated_at":"2026-11-02T14:33:20.488433Z"}],"euvd":[{"id":"EUVD-2017-16263","description":"An issue (known as XSA-212) was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix introduced an insufficient check on XENMEM_exchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arrays.","status":"published","published":"2017-04-04T14:00:00Z","modified":"2024-08-05T15:56:36Z","updated_at":"2026-11-03T02:39:08.892902Z"}],"ghsa":[{"id":"GHSA-xm77-6vqw-642h","title":"An issue (known as XSA-212) was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x,...","description":"An issue (known as XSA-212) was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix introduced an insufficient check on XENMEM_exchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arrays.","status":"published","published":"2022-05-13T01:46:53Z","modified":"2025-04-20T03:36:29Z","cvss":[{"version":"3.0","score":8.2,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-129"],"updated_at":"2026-11-02T15:01:44.058341Z"}],"nvd":[{"id":"CVE-2017-7228","description":"An issue (known as XSA-212) was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix introduced an insufficient check on XENMEM_exchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arrays.","status":"published","published":"2017-04-04T14:59:00.243Z","modified":"2026-06-17T01:23:54.033Z","cvss":[{"version":"3.0","score":8.2,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-129"],"updated_at":"2026-11-02T14:03:44.86906Z"}],"osv":[{"id":"ALPINE-CVE-2017-7228","description":"An issue (known as XSA-212) was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix introduced an insufficient check on XENMEM_exchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arrays.","status":"published","published":"2017-04-04T14:59:00.243Z","modified":"2026-06-15T18:18:07.019794958Z","cvss":[{"version":"3.0","score":8.2,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:47.187336Z"},{"id":"CVE-2017-7228","description":"An issue (known as XSA-212) was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix introduced an insufficient check on XENMEM_exchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arrays.","status":"published","published":"2017-04-04T14:59:00Z","modified":"2026-04-10T04:00:50.477117Z","cvss":[{"version":"3.0","score":8.2,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:06.412595Z"},{"id":"DEBIAN-CVE-2017-7228","description":"An issue (known as XSA-212) was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix introduced an insufficient check on XENMEM_exchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arrays.","status":"published","published":"2017-04-04T14:59:00.243Z","modified":"2026-09-01T20:03:49.823943534Z","cvss":[{"version":"3.0","score":8.2,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.412243Z"},{"id":"UBUNTU-CVE-2017-7228","description":"An issue (known as XSA-212) was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix introduced an insufficient check on XENMEM_exchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arrays.","status":"published","published":"2017-04-04T14:59:00Z","modified":"2026-04-22T11:17:59.231076Z","cvss":[{"version":"3.0","score":8.2,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:15.773974Z"},{"id":"DLA-907-1","title":"xen - security update","status":"published","published":"2017-04-21T00:00:00Z","modified":"2026-03-09T02:10:26.653365Z","updated_at":"2026-11-02T15:46:13.584509Z"},{"id":"DSA-3847-1","title":"xen - security update","status":"published","published":"2017-05-09T00:00:00Z","modified":"2026-03-09T01:21:46.751782Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"SUSE-SU-2017:0983-1","title":"Security update for xen","description":"\nThis update for xen to version 4.7.2 fixes the following issues:\n\nThese security issues were fixed:\n\n- CVE-2017-7228: Broken check in memory_exchange() permited PV guest breakout (bsc#1030442).\n- XSA-206: Unprivileged guests issuing writes to xenstore were able to stall progress of the control domain or driver domain, possibly leading to a Denial of Service (DoS) of the entire host (bsc#1030144).\n- CVE-2017-6505: The ohci_service_ed_list function in hw/usb/hcd-ohci.c allowed local guest OS users to cause a denial of service (infinite loop) via vectors involving the number of link endpoint list descriptors (bsc#1028235).\n\nThese non-security issues were fixed:\n\n- bsc#1015348: libvirtd didn't not start during boot\n- bsc#1014136: kdump couldn't dump a kernel on SLES12-SP2 with Xen hypervisor.\n- bsc#1026236: Fixed paravirtualized performance\n- bsc#1022555: Timeout in 'execution of /etc/xen/scripts/block add'\n- bsc#1029827: Forward port xenstored\n- bsc#1029128: Make xen to really produce xen.efi with gcc48\n","status":"published","published":"2017-04-11T14:35:30Z","modified":"2026-02-04T03:52:57.249658Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2017:1058-1","title":"Security update for xen","description":"\nThis update for xen fixes the following security issues:\n\n- CVE-2017-7228: Broken check in memory_exchange() permited PV guest breakout (bsc#1030442).\n- CVE-2017-6414: Memory leak in the vcard_apdu_new function in card_7816.c in libcacard allowed local guest OS users to cause a denial of service (host memory consumption) via vectors related to allocating a new APDU object (bsc#1027570).\n- CVE-2017-6505: The ohci_service_ed_list function in hw/usb/hcd-ohci.c allowed local guest OS users to cause a denial of service (infinite loop) via vectors involving the number of link endpoint list descriptors (bsc#1028235).\n","status":"published","published":"2017-04-19T07:16:18Z","modified":"2026-02-04T04:38:27.67392Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2017:1080-1","title":"Security update for xen","description":"\nThis update for xen fixes the following issues:\n\nThese security issues were fixed:\n\n- CVE-2017-7228: Broken check in memory_exchange() permited PV guest breakout (bsc#1030442).\n- XSA-206: Unprivileged guests issuing writes to xenstore were able to stall progress of the control domain or driver domain, possibly leading to a Denial of Service (DoS) of the entire host (bsc#1030144).\n- CVE-2017-6505: The ohci_service_ed_list function in hw/usb/hcd-ohci.c allowed local guest OS users to cause a denial of service (infinite loop) via vectors involving the number of link endpoint list descriptors (bsc#1028235).\n- CVE-2017-6414: Memory leak in the vcard_apdu_new function in card_7816.c in libcacard allowed local guest OS users to cause a denial of service (host memory consumption) via vectors related to allocating a new APDU object (bsc#1027570).\n- CVE-2017-2633: The VNC display driver support was vulnerable to an out-of-bounds memory access issue. A user/process inside guest could use this flaw to cause DoS (bsc#1026636).\n- CVE-2016-9603: A privileged user within the guest VM can cause a heap overflow in the device model process, potentially escalating their privileges to that of the device model process (bsc#1028655).\n\nThese non-security issues were fixed:\n\n- bsc#1022555: Timeout in 'execution of /etc/xen/scripts/block add'\n- bsc#1029827: Forward port xenstored\n","status":"published","published":"2017-04-20T13:47:19Z","modified":"2026-02-04T03:25:28.778948Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2017:1081-1","title":"Security update for xen","description":"\nThis update for xen fixes the following issues:\n\nThese security issues were fixed:\n\n- CVE-2017-7228: Broken check in memory_exchange() permited PV guest breakout (bsc#1030442).\n- XSA-206: Unprivileged guests issuing writes to xenstore were able to stall progress of the control domain or driver domain, possibly leading to a Denial of Service (DoS) of the entire host (bsc#1030144).\n- CVE-2016-9603: A privileged user within the guest VM can cause a heap overflow in the device model process, potentially escalating their privileges to that of the device model process (bsc#1028655).\n- CVE-2017-6414: Memory leak in the vcard_apdu_new function in card_7816.c in libcacard allowed local guest OS users to cause a denial of service (host memory consumption) via vectors related to allocating a new APDU object (bsc#1027570).\n- CVE-2017-6505: The ohci_service_ed_list function in hw/usb/hcd-ohci.c allowed local guest OS users to cause a denial of service (infinite loop) via vectors involving the number of link endpoint list descriptors (bsc#1028235).\n- CVE-2017-2633: The VNC display driver support was vulnerable to an out-of-bounds memory access issue. A user/process inside guest could use this flaw to cause DoS (bsc#1026636).\n\nThese non-security issues were fixed:\n\n- bsc#1022555: Timeout in 'execution of /etc/xen/scripts/block add'\n- bsc#1029827: Forward port xenstored\n","status":"published","published":"2017-04-20T13:47:43Z","modified":"2026-02-04T04:16:53.631257Z","updated_at":"2026-11-02T15:53:43.83457Z"}]}}