PT-2019-4884 · Xen+1 · Xen+1
Julian Grall
·
Published
2019-10-31
·
Updated
2023-02-03
·
CVE-2019-18422
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Xen versions prior to 4.13
Description
An issue in Xen allows ARM guest OS users to cause a denial of service or gain privileges by leveraging the erroneous enabling of interrupts. When an exception occurs on an ARM system and is handled without changing processor level, some interrupts are unconditionally enabled during exception entry. This could lead to data corruption, denial of service, or possibly even privilege escalation. A malicious guest might contrive to arrange for critical Xen code to run with interrupts erroneously enabled.
Recommendations
For Xen versions prior to 4.13, consider disabling the handling of exceptions without changing processor level as a temporary workaround until a patch is available. Restrict access to critical Xen code to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
DoS
Incorrect Permission
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Suse
Xen