CVE-2018-12892
published 2018-07-02CVE-2018-12892: An issue was discovered in Xen 4.7 through 4.10.x. libxl fails to pass the readonly flag to qemu when setting up a SCSI disk, due to what was probably an…
PriorityP356critical9.9CVSS 3.0
AVNACLPRLUINSCCHIHAH
EPSS
2.55%
83.3th percentile
An issue was discovered in Xen 4.7 through 4.10.x. libxl fails to pass the readonly flag to qemu when setting up a SCSI disk, due to what was probably an erroneous merge conflict resolution. Malicious guest administrators or (in some situations) users may be able to write to supposedly read-only disk images. Only emulated SCSI disks (specified as "sd" in the libxl disk configuration, or an equivalent) are affected. IDE disks ("hd") are not affected (because attempts to make them readonly are rejected). Additionally, CDROM devices (that is, devices specified to be presented to the guest as CDROMs, regardless of the nature of the backing storage on the host) are not affected; they are always read only. Only systems using qemu-xen (rather than qemu-xen-traditional) as the device model version are vulnerable. Only systems using libxl or libxl-based toolstacks are vulnerable. (This includes xl, and libvirt with the libxl driver.) The vulnerability is present in Xen versions 4.7 and later. (In earlier versions, provided that the patch for XSA-142 has been applied, attempts to create read only disks are rejected.) If the host and guest together usually support PVHVM, the issue is exploitable only if the malicious guest administrator has control of the guest kernel or guest kernel command line.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | xen | < xen 4.8.3+xsa267+shim4.10.1+xsa267-1+deb9u9 (bookworm) | xen 4.8.3+xsa267+shim4.10.1+xsa267-1+deb9u9 (bookworm) |
| xen | xen | >= 0 < 4.8.3+xsa267+shim4.10.1+xsa267-1+deb9u9 | 4.8.3+xsa267+shim4.10.1+xsa267-1+deb9u9 |
| xen | xen | >= 0 < 4.8.3+xsa267+shim4.10.1+xsa267-1+deb9u9 | 4.8.3+xsa267+shim4.10.1+xsa267-1+deb9u9 |
| xen | xen | >= 0 < 4.8.3+xsa267+shim4.10.1+xsa267-1+deb9u9 | 4.8.3+xsa267+shim4.10.1+xsa267-1+deb9u9 |
| xen | xen | >= 0 < 4.8.3+xsa267+shim4.10.1+xsa267-1+deb9u9 | 4.8.3+xsa267+shim4.10.1+xsa267-1+deb9u9 |
| xen | xen | 4.7.0 – 4.10.1 | — |
CVSS provenance
nvdv3.09.9CRITICALCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
osv9.9CRITICAL
vendor_debian9.9CRITICAL
vendor_redhat9.9CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
xen: libxl fails to honour readonly flag on HVM emulated SCSI disks
vendor_redhat·2018-06-27·CVSS 9.9
CVE-2018-12892 [CRITICAL] CWE-285 xen: libxl fails to honour readonly flag on HVM emulated SCSI disks
xen: libxl fails to honour readonly flag on HVM emulated SCSI disks
An issue was discovered in Xen 4.7 through 4.10.x. libxl fails to pass the readonly flag to qemu when setting up a SCSI disk, due to what was probably an erroneous merge conflict resolution. Malicious guest administrators or (in some situations) users may be able to write to supposedly read-only disk images. Only emulated SCSI disks (specified as "sd" in the libxl disk configuration, or an equivalent) are affected. IDE disks ("hd") are not affected (because attempts to make them readonly are rejected). Additionally, CDROM devices (that is, devices specified to be presented to the guest as CDROMs, regardless of the nature of the backing storage on the host) are not affected; they are always read only. Only systems using qe
Debian
CVE-2018-12892: xen - An issue was discovered in Xen 4.7 through 4.10.x. libxl fails to pass the reado...
vendor_debian·2018·CVSS 9.9
CVE-2018-12892 [CRITICAL] CVE-2018-12892: xen - An issue was discovered in Xen 4.7 through 4.10.x. libxl fails to pass the reado...
An issue was discovered in Xen 4.7 through 4.10.x. libxl fails to pass the readonly flag to qemu when setting up a SCSI disk, due to what was probably an erroneous merge conflict resolution. Malicious guest administrators or (in some situations) users may be able to write to supposedly read-only disk images. Only emulated SCSI disks (specified as "sd" in the libxl disk configuration, or an equivalent) are affected. IDE disks ("hd") are not affected (because attempts to make them readonly are rejected). Additionally, CDROM devices (that is, devices specified to be presented to the guest as CDROMs, regardless of the nature of the backing storage on the host) are not affected; they are always read only. Only systems using qemu-xen (rather than qemu-xen-traditional) as the device model version
GHSA
GHSA-pv22-mjm8-4f83: An issue was discovered in Xen 4
ghsa_unreviewed·2022-05-14
CVE-2018-12892 [CRITICAL] CWE-200 GHSA-pv22-mjm8-4f83: An issue was discovered in Xen 4
An issue was discovered in Xen 4.7 through 4.10.x. libxl fails to pass the readonly flag to qemu when setting up a SCSI disk, due to what was probably an erroneous merge conflict resolution. Malicious guest administrators or (in some situations) users may be able to write to supposedly read-only disk images. Only emulated SCSI disks (specified as "sd" in the libxl disk configuration, or an equivalent) are affected. IDE disks ("hd") are not affected (because attempts to make them readonly are rejected). Additionally, CDROM devices (that is, devices specified to be presented to the guest as CDROMs, regardless of the nature of the backing storage on the host) are not affected; they are always read only. Only systems using qemu-xen (rather than qemu-xen-traditional) as the device model version
OSV
CVE-2018-12892: An issue was discovered in Xen 4
osv·2018-07-02·CVSS 9.9
CVE-2018-12892 [CRITICAL] CVE-2018-12892: An issue was discovered in Xen 4
An issue was discovered in Xen 4.7 through 4.10.x. libxl fails to pass the readonly flag to qemu when setting up a SCSI disk, due to what was probably an erroneous merge conflict resolution. Malicious guest administrators or (in some situations) users may be able to write to supposedly read-only disk images. Only emulated SCSI disks (specified as "sd" in the libxl disk configuration, or an equivalent) are affected. IDE disks ("hd") are not affected (because attempts to make them readonly are rejected). Additionally, CDROM devices (that is, devices specified to be presented to the guest as CDROMs, regardless of the nature of the backing storage on the host) are not affected; they are always read only. Only systems using qemu-xen (rather than qemu-xen-traditional) as the device model version
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2018-12892 xen: xsa-266 xen: libxl fails to honour readonly flag on HVM emulated SCSI disks [fedora-all]
bugzilla·2018-06-27·CVSS 9.9
CVE-2018-12892 [CRITICAL] CVE-2018-12892 xen: xsa-266 xen: libxl fails to honour readonly flag on HVM emulated SCSI disks [fedora-all]
CVE-2018-12892 xen: xsa-266 xen: libxl fails to honour readonly flag on HVM emulated SCSI disks [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affe
Bugzilla
CVE-2018-12892 xsa-266 xen: libxl fails to honour readonly flag on HVM emulated SCSI disks
bugzilla·2018-06-13·CVSS 9.9
CVE-2018-12892 [CRITICAL] CVE-2018-12892 xsa-266 xen: libxl fails to honour readonly flag on HVM emulated SCSI disks
CVE-2018-12892 xsa-266 xen: libxl fails to honour readonly flag on HVM emulated SCSI disks
Xen Security Advisory XSA-266
libxl fails to honour readonly flag on HVM emulated SCSI disks
*** EMBARGOED UNTIL 2018-06-27 21:00 UTC ***
ISSUE DESCRIPTION
libxl fails to pass the readonly flag to qemu when setting up a SCSI
disk, due to what was probably an erroneous merge conflict resolution.
IMPACT
Malicious guest administrators or (in some situations) users may be
able to write to supposedly read-only disk images.
VULNERABLE SYSTEMS
Only emulated SCSI disks (specified as "sd" in the libxl disk
configuration, or an equivalent) are affected. IDE disks ("hd") are
not affected (because attempts to make them readonly are rejected).
Additionally, CDROM devices (that is, devices specified to b
http://www.openwall.com/lists/oss-security/2018/06/27/12http://www.securityfocus.com/bid/104571http://www.securitytracker.com/id/1041203http://xenbits.xen.org/xsa/advisory-266.htmlhttps://security.gentoo.org/glsa/201810-06https://www.debian.org/security/2018/dsa-4236http://www.openwall.com/lists/oss-security/2018/06/27/12http://www.securityfocus.com/bid/104571http://www.securitytracker.com/id/1041203http://xenbits.xen.org/xsa/advisory-266.htmlhttps://security.gentoo.org/glsa/201810-06https://www.debian.org/security/2018/dsa-4236
2018-07-02
Published