PT-2018-11456 · Xen+1 · Xen+1
Laura Pardo
·
Publicado
2018-06-27
·
Atualizado
2024-07-29
·
CVE-2018-12893
CVSS v3.1
6.5
Média
| Vetor | AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Xen versions prior to 4.11
Description
An issue in Xen allows a malicious PV guest to crash the system, leading to a Denial of Service. The vulnerability can be triggered by a guest and is caused by an oversight in safety checks added to prevent Xen livelocking with debug exceptions. Only x86 systems are vulnerable, and only x86 PV guests can exploit the issue. An attacker needs to control hardware debugging facilities, which are typically available to unprivileged users.
Recommendations
For Xen versions prior to 4.11, update to version 4.11 or later to resolve the issue. As a temporary workaround, consider restricting access to hardware debugging facilities to minimize the risk of exploitation.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Suse
Xen