Resource management error in Xen - CVE-2019-17345
Published: March 5, 2019 / Updated: July 28, 2020
Vulnerability identifier: #VU17902
CSH Severity: Low
CVSS v4: 8.2 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H]
CVE-ID: CVE-2019-17345
CWE-ID: CWE-399
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to resource management error related to page type reference counting with failed IOMMU update. A local user of guest operating system can use a specially crafted kernel to perform denial of service attack against the host system.
Affected software
Xen
Debian Linux
xen (Alpine package)
xen (Debian package)
Debian Linux
xen (Alpine package)
xen (Debian package)
How to mitigate CVE-2019-17345
Apply the patch:
xen (Debian package) - addressed in versions 4.8.5.final+shim4.10.4-1+deb9u12, 4.11.3+24-g14b62ab3e5-1~deb10u1