CVE-2017-17566

Vulnerability

An issue exists in Xen through version 4.9.x in memory management for PV guests running in shadow mode. When a guest is in shadow mode (required for live migration or VM snapshots), certain auxiliary pages used internally by Xen have their ownership set to the guest itself. The shadow paging code and the main PV memory management code interpret the control structure fields of a page differently when the guest maps such an auxiliary page. This inconsistency can lead to hypervisor crash or memory corruption. All versions of Xen are vulnerable; only x86 systems are affected, and only x86 PV guests running in shadow mode can exploit this. HVM guests are not vulnerable [1][2].

Exploitation

An attacker must have access to a PV guest on a vulnerable x86 Xen host and must ensure that guest is running in shadow mode (e.g., during live migration or VM snapshot operations). The attacker then triggers the mapping of the internally used auxiliary page. The precise steps involve the guest mapping a page it owns but which is also used internally by Xen in shadow mode, causing the conflicting interpretation of page control fields. No special privileges beyond a normal PV guest user are required; the attack can be performed by any user within the guest [1][2].

Impact

Successful exploitation results in a denial of service (DoS) via host hypervisor crash, affecting all domains on the host. Additionally, the advisory states that hypervisor memory corruption is possible and that privilege escalation cannot be ruled out. An attacker could potentially gain host OS privileges [1][2].

Mitigation

Xen has released patches for this issue (XSA-248). Fixed versions are available for Xen 4.9.x and earlier branches; users should update to the latest patched version (e.g., Xen 4.9.1 or later). The Gentoo security advisory recommends upgrading to >=app-emulation/xen-4.9.1-r1 and >=app-emulation/xen-tools-4.9.1-r1 [3]. There is no known workaround [3]. The vulnerability is not known to be listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date.