CVE-2019-17341

HIGH

Xen < 4.11.2 - Denial of Service and Privilege Escalation via PCI Device Page-Writability Race Condition

Title source: llm

Description

An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges by leveraging a page-writability race condition during addition of a passed-through PCI device.

References (5)

Core 5

Core References

Patch, Vendor Advisory x_refsource_confirm

http://xenbits.xen.org/xsa/advisory-285.html

Vendor Advisory x_refsource_misc

https://xenbits.xen.org/xsa/advisory-285.html

Mailing List mailing-list x_refsource_mlist

http://www.openwall.com/lists/oss-security/2019/10/25/6

Third Party Advisory vendor-advisory x_refsource_debian

https://www.debian.org/security/2020/dsa-4602

Mailing List, Third Party Advisory mailing-list x_refsource_bugtraq

https://seclists.org/bugtraq/2020/Jan/21

Scores

CVSS v3 7.8

EPSS 0.0010

EPSS Percentile 27.8%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Details

CWE

CWE-362

Status published

Products (3)

debian/debian_linux 9.0

debian/debian_linux 10.0

xen/xen < 4.11.2

Published Oct 08, 2019

Tracked Since Feb 18, 2026