Pandavirtualization: Exploiting the Xen hypervisor
Summary: Project Zero's Jann Horn reported a Xen bug on 2017-03-14 that lets an attacker controlling the kernel of a paravirtualized x86-64 guest break out of the hypervisor and gain full control of the machine's physical memory; Xen released an advisory and patch on 2017-04-04. Horn built an exploit that, run with root in one 64-bit PV guest, executes a shell command as root in all other 64-bit PV guests, including dom0, on the same physical machine.
What's compelling: The flaw traces to Xen's access_ok() checking only a buffer's start address, so a guest-supplied resumption offset in memory_exchange() lets an attacker write an 8-byte value to an arbitrary hypervisor address - and a single compromised guest kernel then owns every other guest on the host, dom0 included.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026