Xen up to 4.12.x Exception permission assignment

Summaryinfo

A vulnerability was found in Xen up to 4.12.x and classified as critical. This vulnerability affects unknown code of the component Exception Handler. The manipulation results in permission assignment. This vulnerability was named CVE-2019-18422. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in Xen up to 4.12.x (Virtualization Software). It has been classified as critical. Affected is an unknown code of the component Exception Handler. The manipulation with an unknown input leads to a permission assignment vulnerability. CWE is classifying the issue as CWE-732. The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service or gain privileges by leveraging the erroneous enabling of interrupts. Interrupts are unconditionally unmasked in exception handlers. When an exception occurs on an ARM system which is handled without changing processor level, some interrupts are unconditionally enabled during exception entry. So exceptions which occur when interrupts are masked will effectively unmask the interrupts. A malicious guest might contrive to arrange for critical Xen code to run with interrupts erroneously enabled. This could lead to data corruption, denial of service, or possibly even privilege escalation. However a precise attack technique has not been identified.

The weakness was presented 10/31/2019 (oss-sec). The advisory is shared for download at openwall.com. This vulnerability is traded as CVE-2019-18422 since 10/24/2019. It is possible to launch the attack remotely. A authentication is needed for exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 02/01/2024).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

See VDB-144711, VDB-144710, VDB-144709 and VDB-144707 for similar entries. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Virtualization Software

Name

• Xen

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6
• 4.7
• 4.8
• 4.9
• 4.10
• 4.11
• 4.12

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion