CVE-2018-12891
published 2018-07-02CVE-2018-12891: An issue was discovered in Xen through 4.10.x. Certain PV MMU operations may take a long time to process. For that reason Xen explicitly checks for the need to…
PriorityP423medium6.5CVSS 3.0
AVLACLPRLUINSCCNINAH
EPSS
0.43%
35.6th percentile
An issue was discovered in Xen through 4.10.x. Certain PV MMU operations may take a long time to process. For that reason Xen explicitly checks for the need to preempt the current vCPU at certain points. A few rarely taken code paths did bypass such checks. By suitably enforcing the conditions through its own page table contents, a malicious guest may cause such bypasses to be used for an unbounded number of iterations. A malicious or buggy PV guest may cause a Denial of Service (DoS) affecting the entire host. Specifically, it may prevent use of a physical CPU for an indeterminate period of time. All Xen versions from 3.4 onwards are vulnerable. Xen versions 3.3 and earlier are vulnerable to an even wider class of attacks, due to them lacking preemption checks altogether in the affected code paths. Only x86 systems are affected. ARM systems are not affected. Only multi-vCPU x86 PV guests can leverage the vulnerability. x86 HVM or PVH guests as well as x86 single-vCPU PV ones cannot leverage the vulnerability.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | xen | < xen 4.8.3+xsa267+shim4.10.1+xsa267-1+deb9u9 (bookworm) | xen 4.8.3+xsa267+shim4.10.1+xsa267-1+deb9u9 (bookworm) |
| xen | xen | <= 4.10.1 | — |
| xen | xen | >= 0 < 4.8.3+xsa267+shim4.10.1+xsa267-1+deb9u9 | 4.8.3+xsa267+shim4.10.1+xsa267-1+deb9u9 |
| xen | xen | >= 0 < 4.8.3+xsa267+shim4.10.1+xsa267-1+deb9u9 | 4.8.3+xsa267+shim4.10.1+xsa267-1+deb9u9 |
| xen | xen | >= 0 < 4.8.3+xsa267+shim4.10.1+xsa267-1+deb9u9 | 4.8.3+xsa267+shim4.10.1+xsa267-1+deb9u9 |
| xen | xen | >= 0 < 4.8.3+xsa267+shim4.10.1+xsa267-1+deb9u9 | 4.8.3+xsa267+shim4.10.1+xsa267-1+deb9u9 |
CVSS provenance
nvdv3.06.5MEDIUMCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
nvdv2.04.9MEDIUMAV:L/AC:L/Au:N/C:N/I:N/A:C
osv6.5MEDIUM
vendor_debian6.5MEDIUM
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
xen: preemption checks bypassed in x86 PV MM handling (XSA-264)
vendor_redhat·2018-06-27·CVSS 6.5
CVE-2018-12891 [MEDIUM] CWE-358 xen: preemption checks bypassed in x86 PV MM handling (XSA-264)
xen: preemption checks bypassed in x86 PV MM handling (XSA-264)
An issue was discovered in Xen through 4.10.x. Certain PV MMU operations may take a long time to process. For that reason Xen explicitly checks for the need to preempt the current vCPU at certain points. A few rarely taken code paths did bypass such checks. By suitably enforcing the conditions through its own page table contents, a malicious guest may cause such bypasses to be used for an unbounded number of iterations. A malicious or buggy PV guest may cause a Denial of Service (DoS) affecting the entire host. Specifically, it may prevent use of a physical CPU for an indeterminate period of time. All Xen versions from 3.4 onwards are vulnerable. Xen versions 3.3 and earlier are vulnerable to an even wider class of attacks, d
Debian
CVE-2018-12891: xen - An issue was discovered in Xen through 4.10.x. Certain PV MMU operations may tak...
vendor_debian·2018·CVSS 6.5
CVE-2018-12891 [MEDIUM] CVE-2018-12891: xen - An issue was discovered in Xen through 4.10.x. Certain PV MMU operations may tak...
An issue was discovered in Xen through 4.10.x. Certain PV MMU operations may take a long time to process. For that reason Xen explicitly checks for the need to preempt the current vCPU at certain points. A few rarely taken code paths did bypass such checks. By suitably enforcing the conditions through its own page table contents, a malicious guest may cause such bypasses to be used for an unbounded number of iterations. A malicious or buggy PV guest may cause a Denial of Service (DoS) affecting the entire host. Specifically, it may prevent use of a physical CPU for an indeterminate period of time. All Xen versions from 3.4 onwards are vulnerable. Xen versions 3.3 and earlier are vulnerable to an even wider class of attacks, due to them lacking preemption checks altogether in the affected c
GHSA
GHSA-7945-69h3-wr87: An issue was discovered in Xen through 4
ghsa_unreviewed·2022-05-13
CVE-2018-12891 [MEDIUM] GHSA-7945-69h3-wr87: An issue was discovered in Xen through 4
An issue was discovered in Xen through 4.10.x. Certain PV MMU operations may take a long time to process. For that reason Xen explicitly checks for the need to preempt the current vCPU at certain points. A few rarely taken code paths did bypass such checks. By suitably enforcing the conditions through its own page table contents, a malicious guest may cause such bypasses to be used for an unbounded number of iterations. A malicious or buggy PV guest may cause a Denial of Service (DoS) affecting the entire host. Specifically, it may prevent use of a physical CPU for an indeterminate period of time. All Xen versions from 3.4 onwards are vulnerable. Xen versions 3.3 and earlier are vulnerable to an even wider class of attacks, due to them lacking preemption checks altogether in the affected c
OSV
CVE-2018-12891: An issue was discovered in Xen through 4
osv·2018-07-02·CVSS 6.5
CVE-2018-12891 [MEDIUM] CVE-2018-12891: An issue was discovered in Xen through 4
An issue was discovered in Xen through 4.10.x. Certain PV MMU operations may take a long time to process. For that reason Xen explicitly checks for the need to preempt the current vCPU at certain points. A few rarely taken code paths did bypass such checks. By suitably enforcing the conditions through its own page table contents, a malicious guest may cause such bypasses to be used for an unbounded number of iterations. A malicious or buggy PV guest may cause a Denial of Service (DoS) affecting the entire host. Specifically, it may prevent use of a physical CPU for an indeterminate period of time. All Xen versions from 3.4 onwards are vulnerable. Xen versions 3.3 and earlier are vulnerable to an even wider class of attacks, due to them lacking preemption checks altogether in the affected c
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2018-12891 xen: preemption checks bypassed in x86 PV MM handling (XSA-264) [fedora-all]
bugzilla·2018-06-27·CVSS 6.5
CVE-2018-12891 [MEDIUM] CVE-2018-12891 xen: preemption checks bypassed in x86 PV MM handling (XSA-264) [fedora-all]
CVE-2018-12891 xen: preemption checks bypassed in x86 PV MM handling (XSA-264) [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supp
Bugzilla
CVE-2018-12891 xen: preemption checks bypassed in x86 PV MM handling (XSA-264)
bugzilla·2018-06-13·CVSS 6.5
CVE-2018-12891 [MEDIUM] CVE-2018-12891 xen: preemption checks bypassed in x86 PV MM handling (XSA-264)
CVE-2018-12891 xen: preemption checks bypassed in x86 PV MM handling (XSA-264)
ISSUE DESCRIPTION
Certain PV MMU operations may take a long time to process. For that
reason Xen explicitly check for the need to preempt the current vCPU at
certain points. A few rarely taken code paths did bypass such checks.
By suitably enforcing the conditions through its own page table
contents, a malicious guest may cause such bypasses to be used for an
unbounded number of iterations.
IMPACT
A malicious or buggy PV guest may cause a Denial of Service (DoS)
affecting the entire host. Specifically, it may prevent use of a
physical CPU for an indeterminate period of time.
VULNERABLE SYSTEMS
All Xen versions from 3.4 onwards are vulnerable. Xen versions 3.3 and
earlier are vulnerable to an even wider cla
http://www.openwall.com/lists/oss-security/2018/06/27/10http://www.securityfocus.com/bid/104570http://www.securitytracker.com/id/1041201http://xenbits.xen.org/xsa/advisory-264.htmlhttps://lists.debian.org/debian-lts-announce/2018/11/msg00013.htmlhttps://security.gentoo.org/glsa/201810-06https://support.citrix.com/article/CTX235748https://www.debian.org/security/2018/dsa-4236http://www.openwall.com/lists/oss-security/2018/06/27/10http://www.securityfocus.com/bid/104570http://www.securitytracker.com/id/1041201http://xenbits.xen.org/xsa/advisory-264.htmlhttps://lists.debian.org/debian-lts-announce/2018/11/msg00013.htmlhttps://security.gentoo.org/glsa/201810-06https://support.citrix.com/article/CTX235748https://www.debian.org/security/2018/dsa-4236
2018-07-02
Published