Denial of service in Xen - CVE-2018-19964
Published: November 21, 2018 / Updated: December 13, 2018
Vulnerability identifier: #VU16004
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-19964
CWE-ID: CWE-264
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an adjacent attacker to cause DoS condition on the target system.
The weakness exists due to incorrect error handling for guest p2m page removals. An adjacent attacker can cause the service to crash.
The weakness exists due to incorrect error handling for guest p2m page removals. An adjacent attacker can cause the service to crash.
Affected software
Xen
xen (Alpine package)
xen
Fedora
xen (Alpine package)
xen
Fedora
How to mitigate CVE-2018-19964
Install update from vendor's website.
xen - addressed in versions 4.10.2-4.fc28, 4.10.3-1.fc28, 4.10.3-2.fc28, 4.11.0-10.fc29