PT-2019-15696 · Project Acrn · Acrn

Mingyuan18 · Published 2019-11-13 · Updated 2020-11-09 · CVE-2019-18844

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ACRN versions prior to 1.2 ACRN versions prior to 2019w25.5-140000p

Description The issue is related to the Device Model in ACRN, where assert calls in devicemodel/hw/pci/core.c and devicemodel/include/pci core.h are used instead of other mechanisms for propagating error information or diagnostic information. This might allow attackers to cause a denial of service (assertion failure) within the pci core.

Recommendations For ACRN versions prior to 1.1, apply the mitigation 6199e653418e. For ACRN version 1.1, apply the mitigation 2b3dedfb9ba1. For ACRN versions prior to 1.2, update to version 1.2 or later to resolve the issue.

Fix

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

CVE-2019-18844

Affected Products

Acrn

References · 7

• https://github.com/projectacrn/acrn-hypervisor/commit/6199e653418eda58cd698d8769820904453e2535 · Patch
• https://github.com/projectacrn/acrn-hypervisor/commit/2b3dedfb9ba13f15887f22b935d373f36c9a59fa · Patch
• https://osv.dev/vulnerability/CVE-2019-18844 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-18844 · Security Note
• https://github.com/projectacrn/acrn-hypervisor/issues/3252 · Note
• https://github.com/projectacrn/acrn-hypervisor/compare/acrn-2019w25.4-140000p...acrn-2019w25.5-140000p · Note
• https://github.com/shuox/acrn-hypervisor/commit/97b153237c256c586e528eac7fc2f51aedb2b2fc · Note