Executive brief
A vulnerability in the Xen virtualization software could allow a user on a guest virtual machine to gain administrative control over that guest's operating system. This occurs due to a technical error in how the software handles specific processor instructions during emulation. While this allows for privilege escalation within the virtual machine, it does not inherently allow an attacker to escape to the host system or access other customers' data.
Technical details
A privilege escalation vulnerability exists in the Xen x86 instruction emulator's handling of the SYSCALL instruction. The emulator incorrectly raises singlestep (#DB) exceptions based on processor flags present at the start of the instruction rather than the end, deviating from expected hardware behavior for SYSCALL. An unprivileged user in a 64-bit x86 HVM guest can exploit this logic error to trigger an unexpected exception frame, potentially leading to kernel-level privilege escalation within the guest. The vulnerability is most prominent in Xen 4.6 and earlier; in version 4.7 and later, it typically requires specific non-default CPUID configurations or existing hardware access privileges. Linux guests are generally mitigated if they use an Interrupt Stack Table (IST) for #DB handling. Patches are available for supported Xen versions (XSA-204).
Affected products
- Xen Project Xen through 4.8.x
Timeline
- 2016-12-19: advisory: XSA-204 released by Xen Project
- 2017-01-26: disclosed: NVD publication date
- 2017-05-09: patched: Debian security update released