PT-2019-15696 · Project Acrn · Acrn

Mingyuan18 · Publicado 2019-11-13 · Atualizado 2020-11-09 · CVE-2019-18844

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ACRN versions prior to 1.2 ACRN versions prior to 2019w25.5-140000p

Description The issue is related to the Device Model in ACRN, where assert calls in devicemodel/hw/pci/core.c and devicemodel/include/pci core.h are used instead of other mechanisms for propagating error information or diagnostic information. This might allow attackers to cause a denial of service (assertion failure) within the pci core.

Recommendations For ACRN versions prior to 1.1, apply the mitigation 6199e653418e. For ACRN version 1.1, apply the mitigation 2b3dedfb9ba1. For ACRN versions prior to 1.2, update to version 1.2 or later to resolve the issue.

Correção

Assertion Failure

Enumeração de Fraquezas

CWE-617

Identificadores relacionados

CVE-2019-18844

Produtos afetados

Acrn

Referências · 7

• https://github.com/projectacrn/acrn-hypervisor/commit/6199e653418eda58cd698d8769820904453e2535 · Correção
• https://github.com/projectacrn/acrn-hypervisor/issues/3252 · Nota
• https://github.com/projectacrn/acrn-hypervisor/commit/2b3dedfb9ba13f15887f22b935d373f36c9a59fa · Correção
• https://github.com/projectacrn/acrn-hypervisor/compare/acrn-2019w25.4-140000p...acrn-2019w25.5-140000p · Nota
• https://osv.dev/vulnerability/CVE-2019-18844 · Aviso do Fabricante
• https://github.com/shuox/acrn-hypervisor/commit/97b153237c256c586e528eac7fc2f51aedb2b2fc · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-18844 · Nota de Segurança