Vulnerability Description
An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because small IOMMU mappings are unsafely combined into larger ones.
CVSS Score
7.8
HIGH
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Xen | Xen | <= 4.11.1 |
| Debian | Debian Linux | 9.0 |
| Citrix | Xenserver | 7.0 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html
- http://www.securityfocus.com/bid/106182Third Party AdvisoryVDB Entry
- https://lists.debian.org/debian-lts-announce/2019/10/msg00008.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://support.citrix.com/article/CTX239432Third Party Advisory
- https://www.debian.org/security/2019/dsa-4369Third Party Advisory
- https://xenbits.xen.org/xsa/advisory-275.htmlPatchVendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html
- http://www.securityfocus.com/bid/106182Third Party AdvisoryVDB Entry
- https://lists.debian.org/debian-lts-announce/2019/10/msg00008.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://support.citrix.com/article/CTX239432Third Party Advisory
- https://www.debian.org/security/2019/dsa-4369Third Party Advisory
- https://xenbits.xen.org/xsa/advisory-275.htmlPatchVendor Advisory
FAQ
What is CVE-2018-19962?
CVE-2018-19962 is a vulnerability with a CVSS score of 7.8 (HIGH). An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because small IOMMU mappings are unsafely combined into larger ones.
How severe is CVE-2018-19962?
CVE-2018-19962 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-19962?
Check the references section above for vendor advisories and patch information. Affected products include: Xen Xen, Debian Debian Linux, Citrix Xenserver.