NVD Vulnerability Detail

CVE-2018-19965

Summary	An issue was discovered in Xen through 4.11.x allowing 64-bit PV guest OS users to cause a denial of service (host OS crash) because #GP[0] can occur after a non-canonical address is passed to the TLB flushing code. NOTE: this issue exists because of an incorrect CVE-2017-5754 (aka Meltdown) mitigation.
Publication Date	Dec. 8, 2018, 1:29 p.m.
Registration Date	March 1, 2021, 7:15 p.m.
Last Update	Nov. 21, 2024, 12:58 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:o:xen:xen::::::::			4.11.1

Configuration2	or higher	or less	more than	less than
cpe:2.3:a:citrix:xenserver:7.0:::::::*
cpe:2.3:a:citrix:xenserver:7.5:::::::*
cpe:2.3:a:citrix:xenserver:7.6:::::::*
cpe:2.3:a:citrix:xenserver:7.1:cu1:::ltsr:::*

Configuration3		or higher	or less	more than	less than
cpe:2.3:o:debian:debian_linux:9.0:::::::*

Related information, measures and tools

No	URL	タグ
1	http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html
2	http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html
3	http://www.securityfocus.com/bid/106182	Third Party Advisory VDB Entry
4	http://www.securityfocus.com/bid/106182	Third Party Advisory VDB Entry
5	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXC6BME7SXJI2ZIATNXCAH7RGPI4UKTT/
6	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXC6BME7SXJI2ZIATNXCAH7RGPI4UKTT/
7	https://support.citrix.com/article/CTX239432	Patch Third Party Advisory
8	https://support.citrix.com/article/CTX239432	Patch Third Party Advisory
9	https://www.debian.org/security/2019/dsa-4369	Third Party Advisory
10	https://www.debian.org/security/2019/dsa-4369	Third Party Advisory
11	https://xenbits.xen.org/xsa/advisory-279.html	Mitigation Patch Vendor Advisory
12	https://xenbits.xen.org/xsa/advisory-279.html	Mitigation Patch Vendor Advisory

Common Vulnerabilities List

JVN Vulnerability Information

Xen におけるクレンジング、正規化、および比較エラーに関する脆弱性

Title	Xen におけるクレンジング、正規化、および比較エラーに関する脆弱性
Summary	Xen には、クレンジング、正規化、および比較エラーに関する脆弱性が存在します。本脆弱性は、CVE-2017-5754 (別名 Meltdown) と関連する脆弱性です。
Possible impacts	サービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Nov. 20, 2018, midnight
Registration Date	Feb. 8, 2019, 10:26 a.m.
Last Update	Feb. 8, 2019, 10:26 a.m.

Affected System

Xen プロジェクト

Xen 4.11.x まで

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2018-19965	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-CVE-2018-19965
2	CVE-2018-19965	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-CVE-2018-19965
National Vulnerability Database (NVD)
3	CVE-2018-19965	https://nvd.nist.gov/vuln/detail/CVE-2018-19965
4	CVE-2018-19965	https://nvd.nist.gov/vuln/detail/CVE-2018-19965

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-171	http://cwe.mitre.org/data/definitions/171.html
2	CWE-171	http://cwe.mitre.org/data/definitions/171.html

ベンダー情報

No	Name	URL
Xen Security Advisory
1	XSA-279	https://xenbits.xen.org/xsa/advisory-279.html
2	XSA-279	https://xenbits.xen.org/xsa/advisory-279.html

Change Log

No	Changed Details	Date of change
1	[2019年02月08日] 掲載	Feb. 8, 2019, 10:26 a.m.
1	[2019年02月08日] 掲載	Feb. 8, 2019, 10:26 a.m.