What’s Vulnerable › Vulnerabilities

CVE-2018-19962

• Severity: high (CVSS 7.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-12-08 · updated 2026-06-17
• Weakness: CWE-200

Description

An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because small IOMMU mappings are unsafely combined into larger ones.

Affected products

• Citrix XenServer: 7.1-cu1; 7.0, 7.5, 7.6 (and their updates)
• Debian Linux: 9.0 (and their updates)
• xen: through 4.11.1

References

• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html
• http://www.securityfocus.com/bid/106182
• https://lists.debian.org/debian-lts-announce/2019/10/msg00008.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXC6BME7SXJI2ZIATNXCAH7RGPI4UKTT/
• https://support.citrix.com/article/CTX239432
• https://www.debian.org/security/2019/dsa-4369
• https://xenbits.xen.org/xsa/advisory-275.html
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html
• http://www.securityfocus.com/bid/106182
• https://lists.debian.org/debian-lts-announce/2019/10/msg00008.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXC6BME7SXJI2ZIATNXCAH7RGPI4UKTT/
• https://support.citrix.com/article/CTX239432

Get alerted when CVE-2018-19962 or the next vulnerability affects your stack