CVE-2018-19965

CWE-2287 documents7 sources
Severity
5.6MEDIUM
EPSS
0.2%
top 60.43%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
XEN XENCitrix XenserverDebian Debian Linux
Timeline
PublishedDec 8
Latest updateMay 13

Description

An issue was discovered in Xen through 4.11.x allowing 64-bit PV guest OS users to cause a denial of service (host OS crash) because #GP[0] can occur after a non-canonical address is passed to the TLB flushing code. NOTE: this issue exists because of an incorrect CVE-2017-5754 (aka Meltdown) mitigation.

CVSS vector

CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:HExploitability: 1.1 | Impact: 4.0

Affected Packages3 packages

▶Debianxen< 4.11.1-1+3
▶NVDxen/xen4.11.1
▶NVDcitrix/xenserver4 versions+3

Also affects: Debian Linux 9.0

Patches

Patch: support.citrix.com ↗Patch: xenbits.xen.org ↗Patch: support.citrix.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-c3g2-qp55-6gjf: An issue was discovered in Xen through 4↗2022-05-13
▶
OSV
CVE-2018-19965: An issue was discovered in Xen through 4↗2018-12-08
▶
CVEList
CVE-2018-19965: An issue was discovered in Xen through 4↗2018-12-08
▶

📋Vendor Advisories

2
Red Hat
xen: x86: DoS from attempting to use INVPCID with a non-canonical addresses↗2018-11-20
▶
Debian
CVE-2018-19965: xen - An issue was discovered in Xen through 4.11.x allowing 64-bit PV guest OS users ...↗2018
▶

💬Community

1
Bugzilla
CVE-2018-19965 xen: x86: DoS from attempting to use INVPCID with a non-canonical addresses↗2018-11-07
▶
CVE-2018-19965 (MEDIUM CVSS 5.6) | An issue was discovered in Xen thro | cvebase.io