CVE-2018-15468: Medium severity XEN Xen vulnerability
An issue was discovered in Xen through 4.11.x. The DEBUGCTL MSR contains several debugging features, some of which virtualise cleanly, but some do not. In particular, Branch Trace Store is not virtualised by the processor, and software has to be careful to configure it suitably not to lock up the core. As a result, it must only be available to fully trusted guests. Unfortunately, in the case that vPMU is disabled, all value checking was skipped, allowing the guest to choose any MSRDEBUGCTL setting it likes. A malicious or buggy guest administrator (on Intel x86 HVM or PVH) can lock up the entire host, causing a Denial of Service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/xento a version that resolves this vulnerability.Fixed in 4.17.5+72-g01140da4e8-1Fixed in 4.17.7-0+deb12u1Fixed in 4.20.3+127-gc42374a105-0+deb13u1Fixed in 4.20.4+39-gf1e1321c87-0+deb13u1Fixed in 4.20.4+39-gf1e1321c87-1 - Compensating control
Restrict Intel x86 HVM or PVH guest access to fully trusted guests.
Event History
Frequently Asked Questions
What is the severity of CVE-2018-15468?
The severity of CVE-2018-15468 is considered moderate as it involves the potential for system instability and could lead to denial-of-service situations.
How do I fix CVE-2018-15468?
To fix CVE-2018-15468, update the Xen hypervisor to version 4.11.1 or later.
What impact does CVE-2018-15468 have on my system?
CVE-2018-15468 can lead to issues with system stability and may cause the system to lock up under certain conditions.
Is Xen version 4.11.0 vulnerable to CVE-2018-15468?
Yes, Xen version 4.11.0 is vulnerable to CVE-2018-15468 and should be updated to mitigate the risk.
What environments are affected by CVE-2018-15468?
CVE-2018-15468 affects systems running Xen hypervisor versions up to and including 4.11.0.