high
7.5
CWE
362
Advisory Published
Updated

CVE-2019-18421: Race Condition

First published: Thu Oct 31 2019(Updated: )

An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to gain host OS privileges by leveraging race conditions in pagetable promotion and demotion operations. There are issues with restartable PV type change operations. To avoid using shadow pagetables for PV guests, Xen exposes the actual hardware pagetables to the guest. In order to prevent the guest from modifying these page tables directly, Xen keeps track of how pages are used using a type system; pages must be "promoted" before being used as a pagetable, and "demoted" before being used for any other type. Xen also allows for "recursive" promotions: i.e., an operating system promoting a page to an L4 pagetable may end up causing pages to be promoted to L3s, which may in turn cause pages to be promoted to L2s, and so on. These operations may take an arbitrarily large amount of time, and so must be re-startable. Unfortunately, making recursive pagetable promotion and demotion operations restartable is incredibly complicated, and the code contains several races which, if triggered, can cause Xen to drop or retain extra type counts, potentially allowing guests to get write access to in-use pagetables. A malicious PV guest administrator may be able to escalate their privilege to that of the host. All x86 systems with untrusted PV guests are vulnerable. HVM and PVH guests cannot exercise this vulnerability.

Credit: cve@mitre.org

Affected SoftwareAffected VersionHow to fix
debian/xen
4.11.4+107-gef32c7afa2-1
4.14.6-1
4.14.5+94-ge49571868d-1
4.17.2+76-ge1f9cb16e2-1~deb12u1
4.17.2+76-ge1f9cb16e2-1
Xen xen-unstable<=4.12.1
Debian=9.0
Debian=10.0
Fedora=29
Fedora=30
Fedora=31
openSUSE=15.0

Remedy

http://www.openwall.com/lists/oss-security/2019/10/31/3

Remedy

http://xenbits.xen.org/xsa/advisory-299.html

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2019-18421?

    CVE-2019-18421 has been classified with a high severity due to its potential to allow x86 PV guest OS users to gain host OS privileges.

  • How do I fix CVE-2019-18421?

    To remediate CVE-2019-18421, users should update to the latest available versions of Xen that are patched against this vulnerability.

  • What systems are affected by CVE-2019-18421?

    CVE-2019-18421 affects Xen versions prior to 4.12.1 and specific Debian and Fedora versions as listed in the vulnerability details.

  • What type of vulnerability is CVE-2019-18421?

    CVE-2019-18421 is a privilege escalation vulnerability affecting Xen hypervisors through race conditions during pagetable operations.

  • Are there any workarounds for CVE-2019-18421?

    Users should consider using less vulnerable configurations or apply patches provided by their OS distributions until they can fully upgrade Xen.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203