PT-2018-2671 · Amd+1 · Xen+1

Paul Durrant · Publicado 2018-12-07 · Atualizado 2019-10-08 · CVE-2018-19962

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Xen versions prior to 4.12

Description An issue in Xen on AMD x86 platforms allows guest OS users to potentially gain host OS privileges due to the unsafe combination of small IOMMU mappings into larger ones. This could enable an attacker to elevate their privileges.

Recommendations For Xen versions prior to 4.12, update to a version that includes the fix for this issue to prevent potential privilege escalation.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

CWE-264

Identificadores relacionados

BDU:2019-01306

CVE-2018-19962

DLA-1949-1

DSA-4369-1

OPENSUSE-SU-2018_4111-1

OPENSUSE-SU-2018_4304-1

OPENSUSE-SU-2019_1226-1

SUSE-SU-2018:4070-1

SUSE-SU-2018:4300-1

SUSE-SU-2019:0003-1

SUSE-SU-2019:0020-1

SUSE-SU-2019:0825-1

SUSE-SU-2019:0827-1

SUSE-SU-2019:13921-1

SUSE-SU-2019:14011-1

Produtos afetados

Suse

Xen

Referências · 95

• https://suse.com/security/cve/CVE-2018-18849 · Nota
• https://osv.dev/vulnerability/DSA-4369-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-19962 · Nota de Segurança
• https://xenbits.xen.org/xsa/advisory-275.txt · Nota
• https://bugzilla.suse.com/1027519 · Nota
• https://support.citrix.com/article/CTX239432 · Nota
• https://bugzilla.suse.com/1114423 · Nota
• https://bugzilla.suse.com/1115045 · Nota
• https://suse.com/security/cve/CVE-2018-17962 · Nota
• https://bugzilla.suse.com/1115047 · Nota
• https://suse.com/support/update/announcement/2018/suse-su-20184300-1 · Nota
• https://debian.org/security/2019/dsa-4369 · Aviso do Fabricante
• https://bugzilla.suse.com/1127400 · Nota
• https://bugzilla.suse.com/1126192 · Nota
• https://bugzilla.suse.com/1108940 · Nota