Description
An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service (host OS crash) or possibly gain host OS privileges because of an interpretation conflict for a union data structure associated with shadow paging. NOTE: this issue exists because of an incorrect fix for CVE-2017-15595.
References (6)
Scores
CVSS v3
8.8
EPSS
0.0012
EPSS Percentile
31.1%
Attack Vector
LOCAL
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Details
CWE
CWE-436
Status
published
Products (2)
debian/debian_linux
9.0
xen/xen
4.11.0 - 4.11.1
Published
Dec 08, 2018
Tracked Since
Feb 18, 2026