CVE-2018-18883

HIGH

Xen 4.9.0-4.11.0 - Denial of Service via Nested VT-x Restriction Bypass

Title source: llm

Description

An issue was discovered in Xen 4.9.x through 4.11.x, on Intel x86 platforms, allowing x86 HVM and PVH guests to cause a host OS denial of service (NULL pointer dereference) or possibly have unspecified other impact because nested VT-x is not properly restricted.

References (3)

Core 3

Core References

Mitigation, Patch, Vendor Advisory x_refsource_misc

https://xenbits.xen.org/xsa/advisory-278.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1042021

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/105817

Scores

CVSS v3 8.8

EPSS 0.0017

EPSS Percentile 38.0%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Details

CWE

CWE-476

Status published

Products (1)

xen/xen 4.9.0 - 4.11.0

Published Nov 01, 2018

Tracked Since Feb 18, 2026