Denial of service in Xen - CVE-2018-19967
Published: November 13, 2018 / Updated: December 13, 2018
Vulnerability identifier: #VU15998
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-19967
CWE-ID: CWE-264
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an adjacent attacker to cause DoS condition on the target system.
The vulnerability exists due to unspecified flaw. An adjacent attacker can invoke a HLE transaction with the XACQUIRE prefix on the host physical memory range covering the first 4 MiB starting at the 1GiB boundary to cause denial of service conditions on the host system.
Affected software
Xen
xen (Alpine package)
xen (Debian package)
Opensuse
xen (Alpine package)
xen (Debian package)
Opensuse
How to mitigate CVE-2018-19967
Install update from vendor's website.
xen (Alpine package) - update to 4.9.3-r1
xen (Debian package) - update to 4.8.5+shim4.10.2+xsa282-1+deb9u11
xen (Debian package) - update to 4.8.5+shim4.10.2+xsa282-1+deb9u11