What’s Vulnerable › Vulnerabilities

CVE-2018-19961

• Severity: high (CVSS 7.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-12-08 · updated 2026-06-17
• Weakness: CWE-459

Description

An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because TLB flushes do not always occur after IOMMU mapping changes.

Affected products

• Citrix XenServer: 7.1-cu1; 7.0, 7.5, 7.6 (and their updates)
• Debian Linux: 9.0 (and their updates)
• xen: through 4.11.1

References

• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html
• http://www.securityfocus.com/bid/106182
• https://lists.debian.org/debian-lts-announce/2019/10/msg00008.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXC6BME7SXJI2ZIATNXCAH7RGPI4UKTT/
• https://support.citrix.com/article/CTX239432
• https://www.debian.org/security/2019/dsa-4369
• https://xenbits.xen.org/xsa/advisory-275.html
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html
• http://www.securityfocus.com/bid/106182
• https://lists.debian.org/debian-lts-announce/2019/10/msg00008.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXC6BME7SXJI2ZIATNXCAH7RGPI4UKTT/
• https://support.citrix.com/article/CTX239432

Get alerted when CVE-2018-19961 or the next vulnerability affects your stack