Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2018-12891: Xen hypervisor can be stalled by malicious guest
CVE-2018-12891 · published 8 years ago
Summary
All Xen versions from 3.4 onward on x86 systems can be forced to stop processing a CPU when a specially crafted virtual machine runs certain operations. This can cause the whole host to become unresponsive, affecting any Debian Linux server that uses Xen. Upgrade to a patched Xen release or apply the vendor's security update to restore normal preemption checks.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| debian | debian_linux |
8.0 9.0 cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* |
| xen | xen |
<= 4.10.1 cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:* |
Original advisory text
An issue was discovered in Xen through 4.10.x. Certain PV MMU operations may take a long time to process. For that reason Xen explicitly checks for the need to preempt the current vCPU at certain p...
An issue was discovered in Xen through 4.10.x. Certain PV MMU operations may take a long time to process. For that reason Xen explicitly checks for the need to preempt the current vCPU at certain points. A few rarely taken code paths did bypass such checks. By suitably enforcing the conditions through its own page table contents, a malicious guest may cause such bypasses to be used for an unbounded number of iterations. A malicious or buggy PV guest may cause a Denial of Service (DoS) affecting the entire host. Specifically, it may prevent use of a physical CPU for an indeterminate period of time. All Xen versions from 3.4 onwards are vulnerable. Xen versions 3.3 and earlier are vulnerable to an even wider class of attacks, due to them lacking preemption checks altogether in the affected code paths. Only x86 systems are affected. ARM systems are not affected. Only multi-vCPU x86 PV guests can leverage the vulnerability. x86 HVM or PVH guests as well as x86 single-vCPU PV ones cannot leverage the vulnerability.
References
- http://www.openwall.com/lists/oss-security/2018/06/27/10 Mailing List Patch Third Party Advisory
- http://www.securityfocus.com/bid/104570 Third Party Advisory VDB Entry
- http://www.securitytracker.com/id/1041201 Third Party Advisory VDB Entry
- http://xenbits.xen.org/xsa/advisory-264.html Patch Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2018/11/msg00013.html Issue Tracking Third Party Advisory
- https://security.gentoo.org/glsa/201810-06 Third Party Advisory
- https://support.citrix.com/article/CTX235748 Third Party Advisory
- https://www.debian.org/security/2018/dsa-4236 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published2 Jul 2018
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-12891 · NVD
Track software like this
Free during beta