CVE-2018-19961

moderate-risk
Published 2018-12-08

An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because TLB flushes do not always occur after IOMMU mapping changes.

Do I need to act?

-
0.18% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.8/10 High
LOCAL / HIGH complexity

Affected Products (6)

Xen

Affected Vendors

Debian Citrix Xen

References (14)

http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html
Third Party Advisory http://www.securityfocus.com/bid/106182
https://lists.debian.org/debian-lts-announce/2019/10/msg00008.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
Third Party Advisory https://support.citrix.com/article/CTX239432
Third Party Advisory https://www.debian.org/security/2019/dsa-4369
Patch https://xenbits.xen.org/xsa/advisory-275.html
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html
Third Party Advisory http://www.securityfocus.com/bid/106182
https://lists.debian.org/debian-lts-announce/2019/10/msg00008.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
Third Party Advisory https://support.citrix.com/article/CTX239432
Third Party Advisory https://www.debian.org/security/2019/dsa-4369
Patch https://xenbits.xen.org/xsa/advisory-275.html
34
/ 100
moderate-risk
Severity 20/34 · Moderate
Exploitability 1/34 · Minimal
Exposure 13/34 · Low