CVE-2017-10916

The vCPU context-switch implementation in Xen through 4.8.x improperly interacts with the Memory Protection Extensions (MPX) and Protection Key (PKU) features, which makes it easier for guest OS users to defeat ASLR and other protection mechanisms, aka XSA-220.

• CWE-200

• http://www.debian.org/security/2017/dsa-3969
• http://www.securityfocus.com/bid/99167
• http://www.securitytracker.com/id/1038730
• https://security.gentoo.org/glsa/201708-03
• https://xenbits.xen.org/xsa/advisory-220.htmlMailing List, Mitigation, Vendor Advisory
• http://www.debian.org/security/2017/dsa-3969
• http://www.securityfocus.com/bid/99167
• http://www.securitytracker.com/id/1038730
• https://security.gentoo.org/glsa/201708-03
• https://xenbits.xen.org/xsa/advisory-220.htmlMailing List, Mitigation, Vendor Advisory

Published

Jul 5, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-10910MQTT.js 2.x.x prior to 2.15.0 issue in handling PUBLISH tick…
• CVE-2017-10911The make_response function in drivers/block/xen-blkback/blkb…
• CVE-2017-10912Xen through 4.8.x mishandles page transfer, which allows gue…
• CVE-2017-10913The grant-table feature in Xen through 4.8.x provides false …
• CVE-2017-10914The grant-table feature in Xen through 4.8.x has a race cond…
• CVE-2017-10915The shadow-paging feature in Xen through 4.8.x mismanages pa…
• CVE-2017-10917Xen through 4.8.x does not validate the port numbers of poll…
• CVE-2017-10918Xen through 4.8.x does not validate memory allocations durin…
• CVE-2017-10919Xen through 4.8.x mishandles virtual interrupt injection, wh…
• CVE-2017-1092IBM Informix Open Admin Tool 11.5, 11.7, and 12.1 could allo…
• CVE-2017-10920The grant-table feature in Xen through 4.8.x mishandles a GN…
• CVE-2017-10921The grant-table feature in Xen through 4.8.x does not ensure…