PT-2018-13036 · Intel+1 · Xen+1

Andrew Cooper · Published 2018-08-16 · Updated 2024-06-15 · CVE-2018-15468

Positive Technologies (AI Summary)

CVSS v3.1

6.0

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Xen versions prior to 4.12

Description An issue was discovered in Xen where the DEBUGCTL MSR contains several debugging features that are not virtualised cleanly by the processor. Specifically, Branch Trace Store is not virtualised and requires careful software configuration to prevent core lockup. This issue allows a malicious or buggy guest administrator on Intel x86 HVM or PVH to choose any MSR DEBUGCTL setting, potentially locking up the entire host and causing a Denial of Service.

Recommendations For Xen versions prior to 4.12, ensure that vPMU is enabled to prevent guests from configuring MSR DEBUGCTL settings that could lock up the host. As a temporary workaround, consider restricting access to debugging features for untrusted guests until a patch is available.

Fix

DoS

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2018-15468

DSA-4274-1

OPENSUSE-SU-2018_4304-1

OPENSUSE-SU-2024:11520-1

SUSE-SU-2018:3332-1

SUSE-SU-2018:3490-1

SUSE-SU-2018:4300-1

SUSE-SU-2018_3332-1

SUSE-SU-2018_3490-1

SUSE-SU-2018_4300-1

Affected Products

Suse

Xen

References · 130

• https://cve.org/CVERecord?id=CVE-2018-15468 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:11520-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-15468 · Security Note
• https://security.gentoo.org/glsa/201810-06 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:3332-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-15468 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-15468 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:3490-1 · Vendor Advisory
• http://xenbits.xen.org/xsa/advisory-269.html · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4274-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2018-15468 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-15468 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-15468 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-15468 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:4300-1 · Vendor Advisory