An issue was discovered in Xen through 4.11.x allowing 64-bit PV guest OS users to cause a denial of service (host OS crash) because #GP[0] can occur after a non-canonical address is passed to the TLB flushing code. NOTE: this issue exists because of an incorrect CVE-2017-5754 (aka Meltdown) mitigation.
CVSS Details
- CVSS 3.1 Base Score: 5.6
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade xen | Feb 15, 2019 | Dec 8, 2018 |
| Debian | — | Upgrade xen | Jan 16, 2019 | Dec 7, 2018 |
| Suse | — | Upgrade xen-doc-htmlUpgrade xen-develUpgrade xen-tools-xendomains-wait-diskUpgrade xen-libs-32bitUpgrade xen-libsUpgrade xenUpgrade xen-kmp-defaultUpgrade xen-kmp-paeUpgrade xen-tools-domuUpgrade xen-tools | Dec 12, 2018 | Dec 7, 2018 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Dec 8, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub