High severity7.5NVD Advisory· Published Jul 5, 2017· Updated Jun 17, 2026
CVE-2017-10916
CVE-2017-10916
Description
The vCPU context-switch implementation in Xen through 4.8.x improperly interacts with the Memory Protection Extensions (MPX) and Protection Key (PKU) features, which makes it easier for guest OS users to defeat ASLR and other protection mechanisms, aka XSA-220.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
17cpe:2.3:o:xen:xen:4.5.0:*:*:*:*:*:*:*+ 13 more
- cpe:2.3:o:xen:xen:4.5.0:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.5.1:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.5.2:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.5.3:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.5.5:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.6.0:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.6.1:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.6.2:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.6.4:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.6.5:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.7.1:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.8.0:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:4.8.1:*:*:*:*:*:*:*
- (no CPE)range: <=4.8.x
- osv-coords3 versionspkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSSpkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1pkg:rpm/suse/xen&distro=SUSE%20OpenStack%20Cloud%206
< 4.5.5_12-22.18.1+ 2 more
- (no CPE)range: < 4.5.5_12-22.18.1
- (no CPE)range: < 4.5.5_12-22.18.1
- (no CPE)range: < 4.5.5_12-22.18.1
Patches
Vulnerability mechanics
References
5- xenbits.xen.org/xsa/advisory-220.htmlnvdMailing ListMitigationVendor Advisory
- www.debian.org/security/2017/dsa-3969nvd
- www.securityfocus.com/bid/99167nvd
- www.securitytracker.com/id/1038730nvd
- security.gentoo.org/glsa/201708-03nvd
News mentions
0No linked articles in our index yet.