CVE-2019-18420

See a problem?
Source
https://nvd.nist.gov/vuln/detail/CVE-2019-18420
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-18420.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-18420
Related
Published
2019-10-31T14:15:10Z
Modified
2024-09-11T04:29:18.595095Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to cause a denial of service via a VCPUOPinitialise hypercall. hypercallcreatecontinuation() is a variadic function which uses a printf-like format string to interpret its parameters. Error handling for a bad format character was done using BUG(), which crashes Xen. One path, via the VCPUOPinitialise hypercall, has a bad format character. The BUG() can be hit if VCPUOP_initialise executes for a sufficiently long period of time for a continuation to be created. Malicious guests may cause a hypervisor crash, resulting in a Denial of Service (DoS). Xen versions 4.6 and newer are vulnerable. Xen versions 4.5 and earlier are not vulnerable. Only x86 PV guests can exploit the vulnerability. HVM and PVH guests, and guests on ARM systems, cannot exploit the vulnerability.

References

Affected packages

Alpine:v3.9 / xen

Package

Name
xen
Purl
pkg:apk/alpine/xen?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.11.2-r0

Affected versions

4.*

4.0.1-r0
4.0.1-r1
4.0.1-r2
4.0.1-r3
4.1.0-r0
4.1.0-r1
4.1.0-r2
4.1.1-r0
4.1.1-r1
4.1.1-r2
4.1.2-r3
4.1.2-r4
4.1.2-r5
4.1.2-r6
4.1.2-r7
4.1.2-r8
4.1.2-r9
4.1.2-r10
4.1.2-r11
4.1.2-r12
4.1.3-r0
4.2.0-r0
4.2.0-r1
4.2.0-r2
4.2.0-r3
4.2.0-r4
4.2.0-r5
4.2.0-r6
4.2.0-r7
4.2.1-r0
4.2.1-r1
4.2.1-r2
4.2.1-r3
4.2.1-r4
4.2.1-r5
4.2.1-r6
4.2.1-r7
4.2.1-r8
4.2.1-r9
4.2.1-r10
4.2.1-r11
4.2.2-r0
4.2.2-r2
4.2.2-r3
4.2.2-r4
4.2.2-r5
4.2.2-r6
4.2.2-r7
4.2.2-r8
4.2.2-r9
4.2.2-r10
4.2.2-r11
4.3.0-r0
4.3.0-r1
4.3.0-r2
4.3.0-r3
4.3.0-r4
4.3.0-r5
4.3.0-r6
4.3.0-r7
4.3.0-r8
4.3.1-r0
4.3.1-r1
4.3.1-r2
4.3.1-r3
4.3.2-r0
4.3.2-r1
4.3.2-r2
4.3.2-r3
4.3.2-r4
4.3.3-r0
4.4.1-r0
4.4.1-r1
4.4.1-r2
4.4.1-r3
4.4.1-r4
4.4.1-r5
4.4.1-r6
4.4.1-r7
4.4.1-r8
4.4.2-r0
4.4.2-r1
4.5.0-r0
4.5.0-r1
4.5.1-r0
4.5.1-r1
4.5.1-r2
4.5.1-r3
4.6.0-r0
4.6.0-r1
4.6.0-r2
4.6.0-r3
4.6.0-r4
4.6.0-r5
4.6.1-r0
4.6.1-r1
4.6.1-r2
4.6.3-r0
4.6.3-r1
4.7.0-r0
4.7.0-r1
4.7.0-r2
4.7.0-r3
4.7.0-r4
4.7.0-r5
4.7.1-r0
4.7.1-r1
4.7.1-r2
4.7.1-r3
4.7.1-r4
4.7.1-r5
4.7.2-r0
4.8.1-r0
4.8.1-r1
4.8.1-r2
4.8.1-r3
4.8.1-r4
4.9.0-r0
4.9.0-r1
4.9.0-r2
4.9.0-r3
4.9.0-r4
4.9.0-r5
4.9.0-r6
4.9.0-r7
4.9.0-r8
4.9.1-r0
4.9.1-r1
4.9.1-r2
4.9.1-r3
4.10.0-r0
4.10.0-r1
4.10.0-r2
4.10.0-r3
4.10.1-r0
4.10.1-r1
4.10.1-r2
4.11.0-r0
4.11.0-r1
4.11.1-r0
4.11.1-r1
4.11.1-r2

Debian:11 / xen

Package

Name
xen
Purl
pkg:deb/debian/xen?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.11.3+24-g14b62ab3e5-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / xen

Package

Name
xen
Purl
pkg:deb/debian/xen?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.11.3+24-g14b62ab3e5-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / xen

Package

Name
xen
Purl
pkg:deb/debian/xen?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.11.3+24-g14b62ab3e5-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}