Infinite loop in xen (Alpine package)

1) Infinite loop

EUVDB-ID: #VU31981

Risk: Medium

CVSSv3.1: 5.9 [CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-19582

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

Description

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

An issue was discovered in Xen through 4.12.x allowing x86 guest OS users to cause a denial of service (infinite loop) because certain bit iteration is mishandled. In a number of places bitmaps are being used by the hypervisor to track certain state. Iteration over all bits involves functions which may misbehave in certain corner cases: On x86 accesses to bitmaps with a compile time known size of 64 may incur undefined behavior, which may in particular result in infinite loops. A malicious guest may cause a hypervisor crash or hang, resulting in a Denial of Service (DoS). All versions of Xen are vulnerable. x86 systems with 64 or more nodes are vulnerable (there might not be any such systems that Xen would run on). x86 systems with less than 64 nodes are not vulnerable.

Mitigation

Install update from vendor's website.

Vulnerable software versions

xen (Alpine package): 4.8.2-r0 - 4.10.4-r1

External links

http://git.alpinelinux.org/aports/commit/?id=29678cb92eeeb6dc96ec2e86481345797474ddb8
http://git.alpinelinux.org/aports/commit/?id=6a020fa149b82307ca356d1a3fe861420eb56d49
http://git.alpinelinux.org/aports/commit/?id=58d7b94f0134f00815145d95ee720d36d645c72e
http://git.alpinelinux.org/aports/commit/?id=5b04af6c9b65512ad9ff6f687e8651189bd186c5
http://git.alpinelinux.org/aports/commit/?id=8d6c01f17f4285e0142442bb8afcce72f4bd280b

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.