CVE-2018-10471: Medium severity XEN Xen vulnerability

Q: What is the severity of CVE-2018-10471?

CVE-2018-10471 has a severity rating that puts it at risk for denial of service attacks.

Q: How do I fix CVE-2018-10471?

To fix CVE-2018-10471, upgrade to a version of Xen that is higher than 4.10.1.

Q: What systems are affected by CVE-2018-10471?

CVE-2018-10471 affects Xen versions up to and including 4.10.x and certain Debian systems.

Q: What type of vulnerability is CVE-2018-10471?

CVE-2018-10471 is a denial of service vulnerability linked to out-of-bounds zero write issues.

Q: Can CVE-2018-10471 lead to a hypervisor crash?

Yes, CVE-2018-10471 can lead to a crash of the hypervisor due to unexpected INT 80 processing.

Published Apr 27, 2018

Updated

An issue was discovered in Xen through 4.10.x allowing x86 PV guest OS users to cause a denial of service (out-of-bounds zero write and hypervisor crash) via unexpected INT 80 processing, because of an incorrect fix for CVE-2017-5754.

Affected Software

3 affected componentsFixes available

XEN Xen<=4.10.1

Debian Debian Linux=9.0

debian/xen

4.17.5+72-g01140da4e8-14.17.7-0+deb12u14.20.3+127-gc42374a105-0+deb13u14.20.4+39-gf1e1321c87-0+deb13u14.20.4+39-gf1e1321c87-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/xen to a version that resolves this vulnerability.
Fixed in 4.17.5+72-g01140da4e8-1Fixed in 4.17.7-0+deb12u1Fixed in 4.20.3+127-gc42374a105-0+deb13u1Fixed in 4.20.4+39-gf1e1321c87-0+deb13u1Fixed in 4.20.4+39-gf1e1321c87-1

Event History

Apr 27, 2018

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Parent advisories

This vulnerability appears in the following advisories.

DSA-4201

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-1549-1

Frequently Asked Questions

What is the severity of CVE-2018-10471?