CVE-2019-18421Race Condition in XEN

Severity
7.5HIGHNVD
NVD6.6
EPSS
1.9%
top 16.91%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedOct 31
Latest updateMay 24

Description

An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to gain host OS privileges by leveraging race conditions in pagetable promotion and demotion operations. There are issues with restartable PV type change operations. To avoid using shadow pagetables for PV guests, Xen exposes the actual hardware pagetables to the guest. In order to prevent the guest from modifying these page tables directly, Xen keeps track of how pages are used using a type system; pages must be "promo

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.6 | Impact: 5.9

Affected Packages4 packages

debiandebian/xen< xen 4.11.3+24-g14b62ab3e5-1 (bookworm)
Debianxen/xen< 4.11.3+24-g14b62ab3e5-1+3
NVDxen/xen4.12.1
NVDopensuse/leap15.0

Also affects: Debian Linux 10.0, 9.0, Fedora 29, 30, 31

Patches

🔴Vulnerability Details

4
GHSA
GHSA-7g44-3rf3-p4xf: An issue was discovered in Xen through 42022-05-24
GHSA
GHSA-5f2h-r2x9-9p3v: An issue was discovered in Xen through 42022-05-24
OSV
CVE-2019-19580: An issue was discovered in Xen through 42019-12-11
OSV
CVE-2019-18421: An issue was discovered in Xen through 42019-10-31

📋Vendor Advisories

4
Red Hat
xen: Further issues with restartable PV type change operations (XSA-310)2019-12-11
Red Hat
xen: a malicious PV guest administrator may be able to escalate their privilege to that of the host2019-10-31
Debian
CVE-2019-19580: xen - An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to ...2019
Debian
CVE-2019-18421: xen - An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to ...2019

💬Community

2
Bugzilla
CVE-2019-18421 xen: a malicious PV guest administrator may be able to escalate their privilege to that of the host [fedora-all]2019-11-01
Bugzilla
CVE-2019-18421 xen: a malicious PV guest administrator may be able to escalate their privilege to that of the host2019-10-24