Unrated severityNVD Advisory· Published Dec 11, 2019· Updated Aug 5, 2024
CVE-2019-19581
CVE-2019-19581
Description
An issue was discovered in Xen through 4.12.x allowing 32-bit Arm guest OS users to cause a denial of service (out-of-bounds access) because certain bit iteration is mishandled. In a number of places bitmaps are being used by the hypervisor to track certain state. Iteration over all bits involves functions which may misbehave in certain corner cases: On 32-bit Arm accesses to bitmaps with bit a count which is a multiple of 32, an out of bounds access may occur. A malicious guest may cause a hypervisor crash or hang, resulting in a Denial of Service (DoS). All versions of Xen are vulnerable. 32-bit Arm systems are vulnerable. 64-bit Arm systems are not vulnerable.
Affected products
26- Xen/Xendescription
- osv-coords25 versionspkg:rpm/opensuse/xen&distro=openSUSE%20Leap%2015.1pkg:rpm/suse/xen&distro=HPE%20Helion%20OpenStack%208pkg:rpm/suse/xen&distro=SUSE%20Enterprise%20Storage%205pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP4pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP1pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP1pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSSpkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCLpkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSSpkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-BCLpkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-LTSSpkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP4pkg:rpm/suse/xen&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5pkg:rpm/suse/xen&distro=SUSE%20OpenStack%20Cloud%207pkg:rpm/suse/xen&distro=SUSE%20OpenStack%20Cloud%208pkg:rpm/suse/xen&distro=SUSE%20OpenStack%20Cloud%20Crowbar%208
< 4.12.1_06-lp151.2.9.1+ 24 more
- (no CPE)range: < 4.12.1_06-lp151.2.9.1
- (no CPE)range: < 4.9.4_06-3.59.1
- (no CPE)range: < 4.9.4_06-3.59.1
- (no CPE)range: < 4.11.3_02-2.20.1
- (no CPE)range: < 4.10.4_08-3.28.1
- (no CPE)range: < 4.12.1_06-3.9.1
- (no CPE)range: < 4.10.4_08-3.28.1
- (no CPE)range: < 4.12.1_06-3.9.1
- (no CPE)range: < 4.5.5_28-22.64.1
- (no CPE)range: < 4.7.6_06-43.59.1
- (no CPE)range: < 4.7.6_06-43.59.1
- (no CPE)range: < 4.9.4_06-3.59.1
- (no CPE)range: < 4.9.4_06-3.59.1
- (no CPE)range: < 4.11.3_02-2.20.1
- (no CPE)range: < 4.12.1_10-3.8.1
- (no CPE)range: < 4.5.5_28-22.64.1
- (no CPE)range: < 4.7.6_06-43.59.1
- (no CPE)range: < 4.9.4_06-3.59.1
- (no CPE)range: < 4.11.3_02-2.20.1
- (no CPE)range: < 4.12.1_10-3.8.1
- (no CPE)range: < 4.11.3_02-2.20.1
- (no CPE)range: < 4.12.1_10-3.8.1
- (no CPE)range: < 4.7.6_06-43.59.1
- (no CPE)range: < 4.9.4_06-3.59.1
- (no CPE)range: < 4.9.4_06-3.59.1
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
7- lists.opensuse.org/opensuse-security-announce/2020-01/msg00011.htmlmitrevendor-advisoryx_refsource_SUSE
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/34HBFTYNMQMWIO2GGK7DB6KV4M6R5YPV/mitrevendor-advisoryx_refsource_FEDORA
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D5R73AYE53QA32KTMHUVKCX6E52CIS43/mitrevendor-advisoryx_refsource_FEDORA
- security.gentoo.org/glsa/202003-56mitrevendor-advisoryx_refsource_GENTOO
- www.debian.org/security/2020/dsa-4602mitrevendor-advisoryx_refsource_DEBIAN
- seclists.org/bugtraq/2020/Jan/21mitremailing-listx_refsource_BUGTRAQ
- xenbits.xen.org/xsa/advisory-307.htmlmitrex_refsource_MISC
News mentions
0No linked articles in our index yet.