CVE-2019-17346: Input Validation
Published Oct 8, 2019
·Updated
An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges because of an incompatibility between Process Context Identifiers (PCID) and TLB flushes.
Affected Software
4 affected componentsFixes available
debian/xen
4.11.4+107-gef32c7afa2-14.14.6-14.14.5+94-ge49571868d-14.17.2+76-ge1f9cb16e2-1~deb12u14.17.2+76-ge1f9cb16e2-1
XEN Xen<=4.11.2
Debian Debian Linux=9.0
Debian Debian Linux=10.0
Remediation
Patch Available
Event History
Oct 8, 2019
CVE Published
via MITRE·12:02 AM
Data Sourced
via MITRE·12:02 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-17346?
CVE-2019-17346 has a moderate severity level as it can lead to denial of service or privilege escalation for x86 PV guest OS users.
2
How do I fix CVE-2019-17346?
To fix CVE-2019-17346, update your Xen software to version 4.11.4+107-gef32c7afa2-1 or newer.
3
Which versions of Xen are affected by CVE-2019-17346?
CVE-2019-17346 affects Xen versions up to and including 4.11.2.
4
What systems are impacted by CVE-2019-17346?
CVE-2019-17346 impacts x86-based systems running affected versions of Xen, specifically under Debian Linux distributions.
5
Is there a workaround for CVE-2019-17346?
There are no established workarounds for CVE-2019-17346, so upgrading to a patched version is recommended.