NULL pointer dereference in xen (Alpine package)



Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2018-7542
CWE-ID CWE-476
Exploitation vector Local network
Public exploit N/A
Vulnerable software
 xen (Alpine package)
Operating systems & Components / Operating system package or component

Vendor Alpine Linux Development Team

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) NULL pointer dereference

EUVDB-ID: #VU12546

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-7542

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows an adjacent attacker to cause DoS condition on the target system.

The weakness exists due to NULL pointer dereference. An adjacent attacker can cause the service to crash by leveraging the mishandling of configurations that lack a Local APIC.

Mitigation

Install update from vendor's website.

Vulnerable software versions

xen (Alpine package): 4.8.2-r0 - 4.8.2-r5

CPE2.3 External links

https://git.alpinelinux.org/aports/commit/?id=6f854a08591e446ab616d0aac83e843cddcff8a9
https://git.alpinelinux.org/aports/commit/?id=7a017e10fd6de2f5477c69120b540b2cd74652a1
https://git.alpinelinux.org/aports/commit/?id=1fb3325abc8bc3f37fa93c0663908c29e9154087


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###