Xen through 4.8.x mishandles the \contains segment descriptors\ property during GNTTABOP_transfer (aka guest transfer) operations which might allow PV guest OS users to execute arbitrary code on the host OS aka XSA-214.