CVE-2019-18420
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to cause a denial of service via a VCPUOP_initialise hypercall. hypercall_create_continuation() is a variadic function which uses a printf-like format string to interpret its parameters. Error handling for a bad format character was done using BUG(), which crashes Xen. One path, via the VCPUOP_initialise hypercall, has a bad format character. The BUG() can be hit if VCPUOP_initialise executes for a sufficiently long period of time for a continuation to be created. Malicious guests may cause a hypervisor crash, resulting in a Denial of Service (DoS). Xen versions 4.6 and newer are vulnerable. Xen versions 4.5 and earlier are not vulnerable. Only x86 PV guests can exploit the vulnerability. HVM and PVH guests, and guests on ARM systems, cannot exploit the vulnerability.
Se detectó un problema en Xen versiones hasta 4.12.x, permitiendo a usuarios del sistema operativo invitado PV de x86 causar una denegación de servicio por medio de una hipercall de VCPUOP_initialise. hypercall_create_continuation() es una función variadic que utiliza una cadena de formato tipo printf para interpretar sus parámetros. El manejo de errores para un carácter de formato incorrecto fue realizado utilizando BUG(), que bloquea a Xen. Una ruta, por medio de una hypercall VCPUOP_initialise, tiene un carácter de formato incorrecto. El BUG() puede ser golpeado si VCPUOP_initialise es ejecutado durante un período de tiempo suficientemente largo para que una continuación sea creada. Los invitados maliciosos pueden causar un bloqueo del hipervisor, resultando en una Denegación de Servicio (DoS). Xen versiones 4.6 y más recientes son vulnerables. Las versiones de Xen 4.5 y anteriores no son vulnerables. Solo los invitados de PV x86 pueden explotar la vulnerabilidad. Los invitados de HVM y PVH, e invitados en sistemas ARM, no pueden explotar la vulnerabilidad.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-10-24 CVE Reserved
- 2019-10-31 CVE Published
- 2023-11-08 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-134: Use of Externally-Controlled Format String
CAPEC
References (9)
| URL | Tag | Source |
|---|---|---|
| https://seclists.org/bugtraq/2020/Jan/21 | Mailing List |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2019/10/31/1 | 2023-11-07 | |
| http://xenbits.xen.org/xsa/advisory-296.html | 2023-11-07 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Xen Search vendor "Xen" | Xen Search vendor "Xen" for product "Xen" | <= 4.12.1 Search vendor "Xen" for product "Xen" and version " <= 4.12.1" | x86 |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 29 Search vendor "Fedoraproject" for product "Fedora" and version "29" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 30 Search vendor "Fedoraproject" for product "Fedora" and version "30" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 31 Search vendor "Fedoraproject" for product "Fedora" and version "31" | - |
Affected
| ||||||