Permissions, Privileges, and Access Controls in Xen - CVE-2019-18425
Published: November 6, 2019
Vulnerability identifier: #VU22540
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2019-18425
CWE-ID: CWE-264
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vendor: Xen Project
Affected software:
Xen
Xen
Detailed vulnerability description
The vulnerability allows a remote user to escalate privileges on the system.
The vulnerability exists due to missing descriptor table limit checking in x86 PV emulation. A remote unprivileged user of a guest operating system can escalate privileges within the same guest system.
Note, only 32-bit PV guest is affected.
How to mitigate CVE-2019-18425
Applying the appropriate attached patch resolves this issue. xsa298.patch xen-unstable, Xen 4.12.x xsa298-4.11.patch Xen 4.11.x xsa298-4.10.patch Xen 4.10.x xsa298-4.9.patch Xen 4.9.x, Xen 4.8.x, Xen 4.7.x $ sha256sum xsa298* 82c6f626732f99711212155b280270fe2f6683460299b1a6fc3f70b3932970ce xsa298.meta 3f422ad83abb54fe6afed460a5982cf1faa1717e51ab19fbf2375be1b5f8f4a3 xsa298.patch da8d5bad97a46c072dd1715c96401b145cecda14f0303043e6dca313e7ffff0c xsa298-4.9.patch 92dba14b6a208379c2569b9c1c11438da384ec47db2508b4761af30d74a9403d xsa298-4.10.patch d2d8eb5de5601b88f2a6503ecf6bb83207e4b2f17833d61a74fcd185ac7f5a71 xsa298-4.11.patch $