#VU22540 Permissions, Privileges, and Access Controls in Xen - CVE-2019-18425

Vulnerability identifier: #VU22540

Vulnerability risk: Low

CVSSv4.0: 4.8 [CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-18425

CWE-ID: CWE-264

Exploitation vector: Local network

Exploit availability: No

Vulnerable software:
Xen
Server applications / Virtualization software

Vendor: Xen Project

Description

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to missing descriptor table limit checking in x86 PV emulation. A remote unprivileged user of a guest operating system can escalate privileges within the same guest system.

Note, only 32-bit PV guest is affected.

Mitigation

Applying the appropriate attached patch resolves this issue.

xsa298.patch           xen-unstable, Xen 4.12.x
xsa298-4.11.patch      Xen 4.11.x
xsa298-4.10.patch      Xen 4.10.x
xsa298-4.9.patch       Xen 4.9.x, Xen 4.8.x, Xen 4.7.x

$ sha256sum xsa298*
82c6f626732f99711212155b280270fe2f6683460299b1a6fc3f70b3932970ce  xsa298.meta
3f422ad83abb54fe6afed460a5982cf1faa1717e51ab19fbf2375be1b5f8f4a3  xsa298.patch
da8d5bad97a46c072dd1715c96401b145cecda14f0303043e6dca313e7ffff0c  xsa298-4.9.patch
92dba14b6a208379c2569b9c1c11438da384ec47db2508b4761af30d74a9403d  xsa298-4.10.patch
d2d8eb5de5601b88f2a6503ecf6bb83207e4b2f17833d61a74fcd185ac7f5a71  xsa298-4.11.patch
$

Vulnerable software versions

Xen: 4.7.0 - 4.12.1

---

External links
https://www.openwall.com/lists/oss-security/2019/10/31/2
https://xenbits.xen.org/xsa/advisory-298.html

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.