CVE-2019-18420

NameCVE-2019-18420
DescriptionAn issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to cause a denial of service via a VCPUOP_initialise hypercall. hypercall_create_continuation() is a variadic function which uses a printf-like format string to interpret its parameters. Error handling for a bad format character was done using BUG(), which crashes Xen. One path, via the VCPUOP_initialise hypercall, has a bad format character. The BUG() can be hit if VCPUOP_initialise executes for a sufficiently long period of time for a continuation to be created. Malicious guests may cause a hypervisor crash, resulting in a Denial of Service (DoS). Xen versions 4.6 and newer are vulnerable. Xen versions 4.5 and earlier are not vulnerable. Only x86 PV guests can exploit the vulnerability. HVM and PVH guests, and guests on ARM systems, cannot exploit the vulnerability.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-4602-1
NVD severitymedium
Debian Bugs947944

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
xen (PTS)stretch (security), stretch4.8.5.final+shim4.10.4-1+deb9u12fixed
buster4.11.3+24-g14b62ab3e5-1~deb10u1fixed
buster (security)4.11.4+24-gddaaccbbab-1~deb10u1fixed
bullseye, sid4.11.4+24-gddaaccbbab-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
xensource(unstable)4.11.3+24-g14b62ab3e5-1947944
xensourcebuster4.11.3+24-g14b62ab3e5-1~deb10u1DSA-4602-1
xensourcejessie(unfixed)end-of-life
xensourcestretch4.8.5.final+shim4.10.4-1+deb9u12DSA-4602-1

Notes

[jessie] - xen <end-of-life> (Not supported in jessie LTS)
https://xenbits.xen.org/xsa/advisory-296.html

Search for package or bug name: Reporting problems