PT-2019-3033 · Microsoft · Hyper-V+1

Published 2019-08-13 · Updated 2024-05-29 · CVE-2019-0718

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Hyper-V (affected versions not specified)

Description A denial of service issue exists due to insufficient input validation on the host server. This could allow a remote attacker to cause a denial of service using a specially crafted application. The attacker must have a privileged account on a guest operating system running as a virtual machine to exploit this issue. The vulnerability can be exploited by running a specially crafted application that causes the host machine to crash.

Recommendations To address the vulnerability, update the system by modifying how virtual machines access the Hyper-V Network Switch. As a temporary workaround, consider restricting access to the Hyper-V Network Switch to minimize the risk of exploitation. Avoid using specially crafted applications that could cause the host machine to crash until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2019-03015

CVE-2019-0718

Affected Products

Hyper-V

Windows

References · 7

• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2019-0718 · Vendor Advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0718 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0718 · Security Note
• https://bdu.fstec.ru/vul/2019-03015 · Security Note
• https://osv.dev/vulnerability/CVE-2019-0718 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-0718 · Security Note
• https://t.me/cvenotify/81428 · Telegram Post