Xen up to 4.12.x VMX VMEntry Check PV Guest input validation

Summaryinfo

A vulnerability categorized as problematic has been discovered in Xen up to 4.12.x. This issue affects some unknown processing of the component VMX VMEntry Check Handler. Such manipulation as part of PV Guest leads to input validation. This vulnerability is listed as CVE-2019-19583. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Xen up to 4.12.x (Virtualization Software). Affected by this issue is an unknown functionality of the component VMX VMEntry Check Handler. The manipulation as part of a PV Guest leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is availability. CVE summarizes:

An issue was discovered in Xen through 4.12.x allowing x86 HVM/PVH guest OS users to cause a denial of service (guest OS crash) because VMX VMEntry checks mishandle a certain case. Please see XSA-260 for background on the MovSS shadow. Please see XSA-156 for background on the need for #DB interception. The VMX VMEntry checks do not like the exact combination of state which occurs when #DB in intercepted, Single Stepping is active, and blocked by STI/MovSS is active, despite this being a legitimate state to be in. The resulting VMEntry failure is fatal to the guest. HVM/PVH guest userspace code may be able to crash the guest, resulting in a guest Denial of Service. All versions of Xen are affected. Only systems supporting VMX hardware virtual extensions (Intel, Cyrix, or Zhaoxin CPUs) are affected. Arm and AMD systems are unaffected. Only HVM/PVH guests are affected. PV guests cannot leverage the vulnerability.

The weakness was presented 12/11/2019. This vulnerability is handled as CVE-2019-19583 since 12/04/2019. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 03/10/2024).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

See VDB-147007, VDB-147006, VDB-147005 and VDB-147004 for similar entries. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Virtualization Software

Name

• Xen

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6
• 4.7
• 4.8
• 4.9
• 4.10
• 4.11
• 4.12

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion