An issue was discovered in xenvif_set_hash_mapping in drivers/net/xen-netback/hash.c in the...
Vulnerability Description
An issue was discovered in xenvif_set_hash_mapping in drivers/net/xen-netback/hash.c in the Linux kernel through 4.18.1, as used in Xen through 4.11.x and other products. The Linux netback driver allows frontends to control mapping of requests to request queues. When processing a request to set or change this mapping, some input validation (e.g., for an integer overflow) was missing or flawed, leading to OOB access in hash handling. A malicious or buggy frontend may cause the (usually privileged) backend to make out of bounds memory accesses, potentially resulting in one or more of privilege escalation, Denial of Service (DoS), or information leaks.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-15471
Credits & Attribution
No credits recorded in the NVD database.
References
- https://usn.ubuntu.com/3820-1/
- http://xenbits.xen.org/xsa/advisory-270.html
- https://usn.ubuntu.com/3820-2/
- https://bugs.chromium.org/p/project-zero/issues/detail?id=1607
- https://www.debian.org/security/2018/dsa-4313
- https://lists.debian.org/debian-lts-announce/2019/03/msg00017.html
- https://usn.ubuntu.com/3819-1/
- https://usn.ubuntu.com/3820-3/
More from xen
View All →Affected Vendor
Affected Software
Timeline
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.