CVE-2018-19961: High severity xen xapi vulnerability
Published Dec 8, 2018
·Updated
An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because TLB flushes do not always occur after IOMMU mapping changes.
Affected Software
7 affected componentsFixes available
debian/xen
4.11.4+107-gef32c7afa2-14.14.6-14.14.5+94-ge49571868d-14.17.1+2-gb773c48e36-14.17.2+55-g0b56bed864-1
XEN Xen<=4.11.1
Debian Debian Linux=9.0
Citrix XenServer=7.0
Citrix XenServer=7.1-cu1
Citrix XenServer=7.5
Citrix XenServer=7.6
Remediation
Patch Available
Event History
Dec 8, 2018
CVE Published
via MITRE·04:00 AM
Data Sourced
via MITRE·04:00 AM
Description
Frequently Asked Questions
1
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2018-19961.
2
What is the severity level of CVE-2018-19961?
The severity level of CVE-2018-19961 is high.
3
Which platforms are affected by CVE-2018-19961?
CVE-2018-19961 affects AMD x86 platforms.
4
How can guest OS users exploit CVE-2018-19961?
Guest OS users may be able to gain host OS privileges because TLB flushes do not always occur after IOMMU mapping changes.
5
Where can I find more information about CVE-2018-19961?
You can find more information about CVE-2018-19961 in the advisory on xenbits.xen.org and the CVE-2018-19961 page on security-tracker.debian.org.