Denial of service in Xen - CVE-2018-19963

Vulnerability identifier: #VU16003

CSH Severity: Low

CVSS v4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-19963

CWE-ID: CWE-264

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows an adjacent attacker to cause DoS condition on the target system.

The weakness exists due to resource accounting issues in x86 IOREQ server handling. An adjacent attacker can cause the service to crash.

Xen
xen (Alpine package)
xen
Fedora

Install update from vendor's website.

xen - addressed in versions 4.10.2-4.fc28, 4.10.3-1.fc28, 4.10.3-2.fc28, 4.11.0-10.fc29

• http://xenbits.xen.org/xsa/advisory-276.html

• Multiple vulnerabilities in Xen
• Denial of service in xen (Alpine package)
• Fedora 29 update for xen
• Fedora 28 update for xen
• Fedora 28 update for xen
• Fedora 28 update for xen