CVE-2019-18422: High severity xen xapi vulnerability
An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service or gain privileges by leveraging the erroneous enabling of interrupts. Interrupts are unconditionally unmasked in exception handlers. When an exception occurs on an ARM system which is handled without changing processor level, some interrupts are unconditionally enabled during exception entry. So exceptions which occur when interrupts are masked will effectively unmask the interrupts. A malicious guest might contrive to arrange for critical Xen code to run with interrupts erroneously enabled. This could lead to data corruption, denial of service, or possibly even privilege escalation. However a precise attack technique has not been identified.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2019-18422?
CVE-2019-18422 has been classified as a high severity vulnerability due to its potential to cause denial of service and privilege escalation.
How do I fix CVE-2019-18422?
To mitigate CVE-2019-18422, update affected Xen versions to at least 4.11.4+107-gef32c7afa2-1 or a later version.
What systems are affected by CVE-2019-18422?
CVE-2019-18422 affects Xen versions through 4.12.x on ARM systems running specific Debian and Fedora releases.
What type of vulnerability is CVE-2019-18422?
CVE-2019-18422 is a vulnerability that enables denial of service and privilege elevation via improper interrupt handling.
Who can exploit CVE-2019-18422?
CVE-2019-18422 can be exploited by ARM guest OS users due to the erroneous enabling of interrupts in exception handlers.