UBUNTU-CVE-2018-14678
An issue was discovered in the Linux kernel through 4.17.11, as used in Xen through 4.11.x. The xen_failsafe_callback entry point in arch/x86/entry/entry_64.S does not properly maintain RBX, which allows local users to cause a denial of service (uninitialized memory usage and system crash). Within Xen, 64-bit x86 PV Linux guest OS users can trigger a guest OS crash or possibly gain privileges.
02 / AFFECTED SOFTWARE
Affected packages
9 explicit affected versions
4 explicit affected versions
32 explicit affected versions
27 explicit affected versions
47 explicit affected versions
3 explicit affected versions
26 explicit affected versions
21 explicit affected versions
21 explicit affected versions
19 explicit affected versions
20 explicit affected versions
17 explicit affected versions
3 explicit affected versions
22 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
An issue was discovered in the Linux kernel through 4.17.11, as used in Xen through 4.11.x. The xen_failsafe_callback entry point in arch/x86/entry/entry_64.S does not properly maintain RBX, which allows local users to cause a denial of service (uninitialized memory usage and system crash). Within Xen, 64-bit x86 PV Linux guest OS users can trigger a guest OS crash or possibly gain privileges.
05 / REFERENCES
Further evidence
- https://git.kernel.org/linus/b3681dd548d06deb2e1573890829dff4b15abf46
- https://ubuntu.com/security/CVE-2018-14678
- https://ubuntu.com/security/notices/USN-3931-1
- https://ubuntu.com/security/notices/USN-3931-2
- https://www.cve.org/CVERecord?id=CVE-2018-14678
- https://xenbits.xen.org/xsa/advisory-274.html