Published: 31/10/2019 Updated: 07/11/2023

CVSS v2 Base Score: 6.3 | Impact Score: 6.9 | Exploitability Score: 6.8

CVSS v3 Base Score: 6.5 | Impact Score: 3.6 | Exploitability Score: 2.8

VMScore: 561

Vector: AV:N/AC:M/Au:S/C:N/I:N/A:C

An issue exists in Xen up to and including 4.12.x allowing x86 PV guest OS users to cause a denial of service via a VCPUOP_initialise hypercall. hypercall_create_continuation() is a variadic function which uses a printf-like format string to interpret its parameters. Error handling for a bad format character was done using BUG(), which crashes Xen. One path, via the VCPUOP_initialise hypercall, has a bad format character. The BUG() can be hit if VCPUOP_initialise executes for a sufficiently long period of time for a continuation to be created. Malicious guests may cause a hypervisor crash, resulting in a Denial of Service (DoS). Xen versions 4.6 and newer are vulnerable. Xen versions 4.5 and previous versions are not vulnerable. Only x86 PV guests can exploit the vulnerability. HVM and PVH guests, and guests on ARM systems, cannot exploit the vulnerability.

Vulnerable Product	Search on Vulmon	Subscribe to Product
xen xen
debian debian linux 9.0
debian debian linux 10.0
fedoraproject fedora 29
fedoraproject fedora 30
fedoraproject fedora 31

Debian Bug report logs - #947944 xen: Several CVEs open for xen (CVE-2018-12207 CVE-2019-11135 CVE-2019-18420 CVE-2019-18421 CVE-2019-18422 CVE-2019-18423 CVE-2019-18424 CVE-2019-18425 CVE-2019-19577 CVE-2019-19578 CVE-2019-19579 CVE-2019-19580 CVE-2019-19581 CVE-2019-19582 CVE-2019-19583) Package: src:xen; Maintainer for src:xen is De ...

Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in denial of service, guest-to-host privilege escalation or information leaks In addition this update provides mitigations for the TSX Asynchronous Abort speculative side channel attack For additional information please refer to xenbitsxenorg/xsa/adv ...

Description of Problem A number of vulnerabilities have been found in Citrix Hypervisor (formerly Citrix XenServer) that allow the host to be compromised by: i Privileged code in a guest VM that has been assigned a PCI passthrough device ii Privileged code in a PV guest VM iii Unprivileged code in a 32-bit PV guest VM   These vulnerabilitie ...

CWE-134 http://xenbits.xen.org/xsa/advisory-296.html http://www.openwall.com/lists/oss-security/2019/10/31/1 http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00037.html https://www.debian.org/security/2020/dsa-4602 https://seclists.org/bugtraq/2020/Jan/21 https://security.gentoo.org/glsa/202003-56 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2BQKX7M2RHCWDBKNPX4KEBI3MJIH6AYZ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5WWPW4BSZDDW7VHU427XTVXV7ROOFFW/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IZYATWNUGHRBG6I3TC24YHP5Y3J7I6KH/https://nvd.nist.gov https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=947944 https://www.debian.org/security/2020/dsa-4602

CVE-2019-18420

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect