CVE-2019-18425

Current Description

An issue was discovered in Xen through 4.12.x allowing 32-bit PV guest OS users to gain guest OS privileges by installing and using descriptors. There is missing descriptor table limit checking in x86 PV emulation. When emulating certain PV guest operations, descriptor table accesses are performed by the emulating code. Such accesses should respect the guest specified limits, unless otherwise guaranteed to fail in such a case. Without this, emulation of 32-bit guest user mode calls through call gates would allow guest user mode to install and then use descriptors of their choice, as long as the guest kernel did not itself install an LDT. (Most OSes don't install any LDT by default). 32-bit PV guest user mode can elevate its privileges to that of the guest kernel. Xen versions from at least 3.2 onwards are affected. Only 32-bit PV guest user mode can leverage this vulnerability. HVM, PVH, as well as 64-bit PV guests cannot leverage this vulnerability. Arm systems are unaffected.

Basic Data

PublishedOctober 31, 2019
Last ModifiedNovember 14, 2019
Assignercve@mitre.org
Data TypeCVE
Data FormatMITRE
Data Version4.0
Problem TypeCWE-269
CVE Data Version4.0

Base Metric V2

CVSS 2 - Version2.0
CVSS 2 - Vector StringAV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS 2 - Access VectorNETWORK
CVSS 2 - Access ComplexityMEDIUM
CVSS 2 - AuthenticationNONE
CVSS 2 - Confidentiality ImpactCOMPLETE
CVSS 2 - Availability ImpactCOMPLETE
CVSS 2 - Base Score9.3
SeverityHIGH
Exploitability Score8.6
Impact Score10.0
Obtain All Privilegefalse
Obtain User Privilegefalse
Obtain Other Privilegefalse

Base Metric V3

No data provided.

Configurations

  • OR - Configuration 1
    Cpe VersionPartVendorProductVersionUpdateEditionLanguageSW EditionTarget SWTarget HWOtherVersion Start IncludingVersion End IncludingVersion Start ExcludingVersion End Excluding
    2.3OSXenXen******x86*4.12.1

Vulnerable Software List

VendorProductVersions
Xen Xen *

References

NameSourceURLTags
openSUSE-SU-2019:2506http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00037.htmlSUSE
[oss-security] 20191031 Xen Security Advisory 298 v3 (CVE-2019-18425) - missing descriptor table limit checking in x86 PV emulationhttp://www.openwall.com/lists/oss-security/2019/10/31/2MLISTMailing List Third Party Advisory
http://xenbits.xen.org/xsa/advisory-298.htmlhttp://xenbits.xen.org/xsa/advisory-298.htmlMISCPatch Vendor Advisory
FEDORA-2019-865bb16900https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2BQKXFEDORA
FEDORA-2019-376ec5c107https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I5WWPFEDORA
FEDORA-2019-cbb732f760https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IZYATFEDORA
20200114 [SECURITY] [DSA 4602-1] xen security updatehttps://seclists.org/bugtraq/2020/Jan/21BUGTRAQ
GLSA-202003-56https://security.gentoo.org/glsa/202003-56GENTOO
DSA-4602https://www.debian.org/security/2020/dsa-4602DEBIAN