CVE-2018-15468

An issue was discovered in Xen through 4.11.x. The DEBUGCTL MSR contains several debugging features, some of which virtualise cleanly, but some do not. In particular, Branch Trace Store is not virtualised by the processor, and software has to be careful to configure it suitably not to lock up the core. As a result, it must only be available to fully trusted guests. Unfortunately, in the case that vPMU is disabled, all value checking was skipped, allowing the guest to choose any MSR_DEBUGCTL setting it likes. A malicious or buggy guest administrator (on Intel x86 HVM or PVH) can lock up the entire host, causing a Denial of Service.

CVSS v3 6.0 MEDIUM
CVSS v2.0 4.9 MEDIUM

6.0^/10

CVSS v3 : MEDIUM

Vector : AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

Exploitability : 1.5 / Impact : 4.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope CHANGED

4.9^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:L/Au:N/C:N/I:N/A:C

Exploitability : 3.9 / Impact : 6.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact COMPLETE

References

Link	Resource
http://xenbits.xen.org/xsa/advisory-269.html	Vendor Advisory
https://security.gentoo.org/glsa/201810-06	Third Party Advisory
http://xenbits.xen.org/xsa/advisory-269.html	Vendor Advisory
https://security.gentoo.org/glsa/201810-06	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*

History

21 Nov 2024, 03:50

Type	Values Removed	Values Added
References	~~() http://xenbits.xen.org/xsa/advisory-269.html - Vendor Advisory~~	() http://xenbits.xen.org/xsa/advisory-269.html - Vendor Advisory
References	~~() https://security.gentoo.org/glsa/201810-06 - Third Party Advisory~~	() https://security.gentoo.org/glsa/201810-06 - Third Party Advisory

Information

Published : 2018-08-17 18:29

Updated : 2024-11-21 03:50

NVD link : CVE-2018-15468

Mitre link : CVE-2018-15468

CVE.ORG link : CVE-2018-15468

JSON object : View

Products Affected

xen

xen

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2018-15468", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:C", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 6.0, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 1.5}]}, "published": "2018-08-17T18:29:00.740", "references": [{"url": "http://xenbits.xen.org/xsa/advisory-269.html", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://security.gentoo.org/glsa/201810-06", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://xenbits.xen.org/xsa/advisory-269.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.gentoo.org/glsa/201810-06", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Xen through 4.11.x. The DEBUGCTL MSR contains several debugging features, some of which virtualise cleanly, but some do not. In particular, Branch Trace Store is not virtualised by the processor, and software has to be careful to configure it suitably not to lock up the core. As a result, it must only be available to fully trusted guests. Unfortunately, in the case that vPMU is disabled, all value checking was skipped, allowing the guest to choose any MSR_DEBUGCTL setting it likes. A malicious or buggy guest administrator (on Intel x86 HVM or PVH) can lock up the entire host, causing a Denial of Service."}, {"lang": "es", "value": "Se ha descubierto un problema en Xen hasta las versiones 4.11.x. DUBGCTL MSR contiene varias caracter\u00edsticas de depuraci\u00f3n, de las cuales algunas virtualizan limpiamente, pero otras no. En particular, Bnach Trace Store no lo virtualiza el procesador y el software tiene que configurarse con cuidado para no bloquear el n\u00facleo. Como resultado, solo debe estar disponible para guests de total confianza. Desafortunadamente, en el caso de que vPMU est\u00e9 deshabilitado, se omiti\u00f3 toda comprobaci\u00f3n de valores, permitiendo al guest elegir cualquier configuraci\u00f3n MSR_DEBUGCTL que desee. Un administrador guest malicioso o con errores (en Intel x86 HVM o PVH) puede bloquear todo el host, provocando una denegaci\u00f3n de servicio."}], "lastModified": "2024-11-21T03:50:52.337", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CDF60B9D-F0FE-401D-9864-7A70BE5631DD", "versionEndIncluding": "4.11.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}