PT-2018-2670 · Amd+1 · Xen+1
Paul Durrant
·
Publicado
2018-12-07
·
Atualizado
2024-06-15
·
CVE-2018-19961
CVSS v3.1
7.8
Alta
| Vetor | AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Xen versions prior to 4.12
Description
An issue in Xen on AMD x86 platforms may allow guest OS users to gain host OS privileges due to TLB flushes not always occurring after IOMMU mapping changes. The vulnerability is related to an incorrect TLB flush after IOMMU mapping changes, which can be exploited to elevate privileges.
Recommendations
For Xen versions prior to 4.12, update to version 4.12 or later to resolve the issue. As a temporary workaround, consider implementing additional access controls to minimize the risk of privilege escalation. Restrict access to sensitive resources and limit the privileges of guest OS users to reduce the potential impact of exploitation.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Suse
Xen