Memory corruption in Xen - CVE-2018-15470
Published: August 21, 2018
Vulnerability identifier: #VU14473
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-15470
CWE-ID: CWE-119
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an adjacent attacker to cause DoS condition on the target system.
The vulnerability exists due to the affected software fails to enforce the quota-maxentity setting. An adjacent attacker can write an excessive number of XenStore entries, trigger unbounded memory usage and cause the service to crash.
Affected software
Xen
Gentoo Linux
Opensuse
Fedora
xen (Alpine package)
xen
Gentoo Linux
Opensuse
Fedora
xen (Alpine package)
xen
How to mitigate CVE-2018-15470
Install update from vendor's website.
xen (Alpine package) - update to 4.8.5-r0
xen - addressed in versions 4.9.2-7.fc27, 4.10.1-6.fc28
xen - addressed in versions 4.9.2-7.fc27, 4.10.1-6.fc28