Denial of service in Xen - CVE-2018-12891
Published: June 28, 2018 / Updated: June 29, 2018
Vulnerability identifier: #VU13520
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-12891
CWE-ID: CWE-264
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an adjacent attacker to cause DoS condition on the target system.
The vulnerability exists on x86 systems due to unspecified flaw. An adjacent attacker can invoke certain PV MMU operations to preempt the current vCPU, prevent use of a physical CPU and cause the system to crash.
Affected software
Xen
Debian Linux
Gentoo Linux
Opensuse
Fedora
xen (Alpine package)
xen
Debian Linux
Gentoo Linux
Opensuse
Fedora
xen (Alpine package)
xen
How to mitigate CVE-2018-12891
Install update from vendor's website.
xen (Alpine package) - update to 4.7.6-r0
xen - addressed in versions 4.9.2-6.fc27, 4.10.1-5.fc28
xen - addressed in versions 4.9.2-6.fc27, 4.10.1-5.fc28