CVE-2018-19961
First published: Sat Dec 08 2018(Updated: )
An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because TLB flushes do not always occur after IOMMU mapping changes.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/xen | 4.11.4+107-gef32c7afa2-1 4.14.6-1 4.14.5+94-ge49571868d-1 4.17.1+2-gb773c48e36-1 4.17.2+55-g0b56bed864-1 | |
| Xen Xen | <=4.11.1 | |
| Debian Debian Linux | =9.0 | |
| Citrix XenServer | =7.0 | |
| Citrix XenServer | =7.1-cu1 | |
| Citrix XenServer | =7.5 | |
| Citrix XenServer | =7.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://xenbits.xen.org/xsa/advisory-275.txt
- https://security-tracker.debian.org/tracker/CVE-2018-19961
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html
- http://www.securityfocus.com/bid/106182
- https://lists.debian.org/debian-lts-announce/2019/10/msg00008.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UXC6BME7SXJI2ZIATNXCAH7RGPI4UKTT/
- https://support.citrix.com/article/CTX239432
- https://www.debian.org/security/2019/dsa-4369
- https://xenbits.xen.org/xsa/advisory-275.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXC6BME7SXJI2ZIATNXCAH7RGPI4UKTT/
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2018-19961.
What is the severity level of CVE-2018-19961?
The severity level of CVE-2018-19961 is high.
Which platforms are affected by CVE-2018-19961?
CVE-2018-19961 affects AMD x86 platforms.
How can guest OS users exploit CVE-2018-19961?
Guest OS users may be able to gain host OS privileges because TLB flushes do not always occur after IOMMU mapping changes.
Where can I find more information about CVE-2018-19961?
You can find more information about CVE-2018-19961 in the advisory on xenbits.xen.org and the CVE-2018-19961 page on security-tracker.debian.org.
- collector/security-tracker-debian
- collector/nvd-index
- agent/tags
- agent/severity
- agent/weakness
- agent/references
- agent/author
- agent/type
- agent/description
- agent/event
- agent/last-modified-date
- agent/remedy
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- package-manager/debian
- vendor/xen
- canonical/xen xen
- version/xen xen/4.11.1
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0
- vendor/citrix
- canonical/citrix xenserver
- version/citrix xenserver/7.0
- version/citrix xenserver/7.1-cu1
- version/citrix xenserver/7.5
- version/citrix xenserver/7.6