high7.8
CVE-2018-14678
An issue was discovered in the Linux kernel through 4.17.11, as used in Xen through 4.11.x.
Impact
An issue was discovered in the Linux kernel through 4.17.11, as used in Xen through 4.11.x. The xen_failsafe_callback entry point in arch/x86/entry/entry_64.S does not properly maintain RBX, which allows local users to cause a denial of service (uninitialized memory usage and system crash). Within Xen, 64-bit x86 PV Linux guest OS users can trigger a guest OS crash or possibly gain privileges.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Linux | Linux Kernel | from 4.14.21 before 4.14.61 from 4.15.5 before 4.17.13 |
| Xen | Xen | through 4.11.0 |
| Debian | Debian Linux | Versions 8.0, 9.0 |
| Canonical | Ubuntu Linux | Versions 14.04, 16.04, 18.04 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.securityfocus.com/bid/104924
- http://www.securitytracker.com/id/1041397
- https://lists.debian.org/debian-lts-announce/2018/10/msg00003.html
- https://usn.ubuntu.com/3931-1/
- https://usn.ubuntu.com/3931-2/
- https://www.debian.org/security/2018/dsa-4308
- https://xenbits.xen.org/xsa/advisory-274.html
- http://www.securityfocus.com/bid/104924
- http://www.securitytracker.com/id/1041397
- https://lists.debian.org/debian-lts-announce/2018/10/msg00003.html
- https://usn.ubuntu.com/3931-1/
- https://usn.ubuntu.com/3931-2/
- https://www.debian.org/security/2018/dsa-4308
- https://xenbits.xen.org/xsa/advisory-274.html