CVE-2019-18423

high
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service via a XENMEM_add_to_physmap hypercall. p2m->max_mapped_gfn is used by the functions p2m_resolve_translation_fault() and p2m_get_entry() to sanity check guest physical frame. The rest of the code in the two functions will assume that there is a valid root table and check that with BUG_ON(). The function p2m_get_root_pointer() will ignore the unused top bits of a guest physical frame. This means that the function p2m_set_entry() will alias the frame. However, p2m->max_mapped_gfn will be updated using the original frame. It would be possible to set p2m->max_mapped_gfn high enough to cover a frame that would lead p2m_get_root_pointer() to return NULL in p2m_get_entry() and p2m_resolve_translation_fault(). Additionally, the sanity check on p2m->max_mapped_gfn is off-by-one allowing "highest mapped + 1" to be considered valid. However, p2m_get_root_pointer() will return NULL. The problem could be triggered with a specially crafted hypercall XENMEM_add_to_physmap{, _batch} followed by an access to an address (via hypercall or direct access) that passes the sanity check but cause p2m_get_root_pointer() to return NULL. A malicious guest administrator may cause a hypervisor crash, resulting in a Denial of Service (DoS). Xen version 4.8 and newer are vulnerable. Only Arm systems are vulnerable. x86 systems are not affected.

References

http://www.openwall.com/lists/oss-security/2019/10/31/4

http://xenbits.xen.org/xsa/advisory-301.html

https://lists.fedoraproject.org/archives/list/[email protected]/message/2BQKX7M2RHCWDBKNPX4KEBI3MJIH6AYZ/

https://lists.fedoraproject.org/archives/list/[email protected]/message/I5WWPW4BSZDDW7VHU427XTVXV7ROOFFW/

https://lists.fedoraproject.org/archives/list/[email protected]/message/IZYATWNUGHRBG6I3TC24YHP5Y3J7I6KH/

https://seclists.org/bugtraq/2020/Jan/21

https://security.gentoo.org/glsa/202003-56

https://www.debian.org/security/2020/dsa-4602

Details

Source: MITRE

Published: 2019-10-31

Updated: 2020-08-24

Type: CWE-193

Risk Information

CVSS v2

Base Score: 8.5

Vector: AV:N/AC:M/Au:S/C:C/I:C/A:C

Impact Score: 10

Exploitability Score: 6.8

Severity: HIGH

CVSS v3

Base Score: 8.8

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Impact Score: 5.9

Exploitability Score: 2.8

Severity: HIGH

Vulnerable Software

Configuration 1

OR

cpe:2.3:o:xen:xen:*:*:*:*:*:*:arm:* versions from 4.8 to 4.12.1 (inclusive)

Tenable Plugins

View all (11 total)

IDNameProductFamilySeverity
134964GLSA-202003-56 : Xen: Multiple vulnerabilities (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)NessusGentoo Local Security Checks
critical
132934Xen Denial of Service Vulnerability (XSA-301)NessusMisc.
high
132875Debian DSA-4602-1 : xen - security update (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout)NessusDebian Local Security Checks
critical
132092SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2019:3310-1)NessusSuSE Local Security Checks
high
132091SUSE SLED15 / SLES15 Security Update : xen (SUSE-SU-2019:3309-1)NessusSuSE Local Security Checks
high
132073SUSE SLES12 Security Update : xen (SUSE-SU-2019:3297-1)NessusSuSE Local Security Checks
critical
131460Fedora 30 : xen (2019-cbb732f760)NessusFedora Local Security Checks
critical
131143Fedora 31 : xen (2019-376ec5c107)NessusFedora Local Security Checks
critical
131098Fedora 29 : xen (2019-865bb16900)NessusFedora Local Security Checks
critical
131062openSUSE Security Update : xen (openSUSE-2019-2508)NessusSuSE Local Security Checks
critical
130959SUSE SLED15 / SLES15 Security Update : xen (SUSE-SU-2019:2961-1)NessusSuSE Local Security Checks
critical