PT-2018-3391 · Xen+1 · Xen+1

Paul Durrant · Published 2018-12-07 · Updated 2024-06-15 · CVE-2018-19964

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Xen versions 4.11.x

Description: An issue in Xen allows x86 guest OS users to cause a denial of service, resulting in the host OS hanging. This occurs because the p2m lock remains unavailable indefinitely in certain error conditions. The vulnerability is related to incorrect error handling.

Recommendations: For Xen version 4.11.x, consider applying configuration changes to mitigate the risk of denial of service, such as adjusting error handling mechanisms to prevent the p2m lock from remaining unavailable indefinitely. However, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-388

Related Identifiers

BDU:2020-00738

CVE-2018-19964

OPENSUSE-SU-2024:11520-1

SUSE-SU-2019:0003-1

Affected Products

Suse

Xen

References · 122

• https://osv.dev/vulnerability/CVE-2018-19964 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11520-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2018-19964 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-19964 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-19964 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00738 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-19964 · Security Note
• https://xenbits.xen.org/xsa/advisory-277.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:0003-1 · Vendor Advisory
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=57444186 · Vendor Advisory
• https://suse.com/security/cve/CVE-2016-10025 · Note
• https://bugzilla.suse.com/1027519 · Note
• https://suse.com/security/cve/CVE-2020-29481 · Note
• https://bugzilla.suse.com/1115047 · Note
• https://suse.com/security/cve/CVE-2020-29570 · Note