CVE-2019-19580

Severity Score

6.6

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to gain host OS privileges by leveraging race conditions in pagetable promotion and demotion operations, because of an incomplete fix for CVE-2019-18421. XSA-299 addressed several critical issues in restartable PV type change operations. Despite extensive testing and auditing, some corner cases were missed. A malicious PV guest administrator may be able to escalate their privilege to that of the host. All security-supported versions of Xen are vulnerable. Only x86 systems are affected. Arm systems are not affected. Only x86 PV guests can leverage the vulnerability. x86 HVM and PVH guests cannot leverage the vulnerability. Note that these attacks require very precise timing, which may be difficult to exploit in practice.

Se detectó un problema en Xen versiones hasta 4.12.x permitiendo a usuarios del Sistema Operativo invitado x86 PV conseguir privilegios de Sistema Operativo host al aprovechar las condiciones de carrera en las operaciones de promoción y degradación de tablas de páginas, debido a una solución incompleta para CVE-2019-18421. XSA-299 abordó varios problemas críticos en las operaciones de cambio de tipo PV reiniciables. A pesar de las extensas pruebas y auditorías, se perdieron algunos casos de esquina. Un administrador invitado malicioso de PV puede escalar sus privilegios a los del host. Todas las versiones de seguridad de Xen son vulnerables. Solo los sistemas en x86 están afectados. Los sistemas ARM no están afectados. Solo los invitados de PV en x86 pueden aprovechar la vulnerabilidad. Los invitados x86 HVM y PVH no pueden aprovechar la vulnerabilidad. Tenga en cuenta que estos ataques requieren un tiempo muy preciso, que puede ser difícil de explotar en la práctica.

*Credits: N/A

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Medium

Authentication

Single

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2019-12-04 CVE Reserved
2019-12-11 CVE Published
2024-04-05 EPSS Updated
2024-08-05 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CAPEC

References (7)

URL	Tag	Source
https://seclists.org/bugtraq/2020/Jan/21	Mailing List

URL	Date	SRC

URL	Date	SRC
https://xenbits.xen.org/xsa/advisory-310.html	2023-11-07

URL	Date	SRC
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00011.html	2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/34HBFTYNMQMWIO2GGK7DB6KV4M6R5YPV	2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D5R73AYE53QA32KTMHUVKCX6E52CIS43	2023-11-07
https://security.gentoo.org/glsa/202003-56	2023-11-07
https://www.debian.org/security/2020/dsa-4602	2023-11-07

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Xen Search vendor "Xen"		Xen Search vendor "Xen" for product "Xen"				<= 4.12.1 Search vendor "Xen" for product "Xen" and version " <= 4.12.1"		x86		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				31 Search vendor "Fedoraproject" for product "Fedora" and version "31"		-		Affected