Unscored severity · published Aug 12, 2011
CVE-2011-1898
Xen 4.1 before 4.1.1 and 4.0 before 4.0.2, when using PCI passthrough on Intel VT-d chipsets that do not have interrupt remapping, allows guest OS users to gain host OS privileges…
–
CVSS
0.9%
EPSS
No
On KEV
Description
Xen 4.1 before 4.1.1 and 4.0 before 4.0.2, when using PCI passthrough on Intel VT-d chipsets that do not have interrupt remapping, allows guest OS users to gain host OS privileges by "using DMA to generate MSI interrupts by writing to the interrupt injection registers."
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
XE
Xen · Citrix
4.0.0; 4.0.1; 4.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-1898
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-1898
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2011-June/062112.html
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2011-June/062139.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00017.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2011-08/msg00018.html
theinvisiblethings.blogspot.com
http://theinvisiblethings.blogspot.com/2011/05/following-white-rabbit-software-attacks.html
Exploit
http://www.invisiblethingslab.com/resources/2011/Software%20Attacks%20on%20Intel%20VT-d.pdf
More from Xen
–
CVE-2011-3262
tools/libxc/xc_dom_bzimageloader.c in Xen 3.2, 3.3, 4.0, and 4.1 allows local users to cause a denial of service (management software infinite loop and management domain resource…
–
CVE-2011-1583
Multiple integer overflows in tools/libxc/xc_dom_bzimageloader.c in Xen 3.2, 3.3, 4.0, and 4.1 allow local users to cause a denial of service and possibly execute arbitrary code…
–
CVE-2010-4255
The fixup_page_fault function in arch/x86/traps.c in Xen 4.0.1 and earlier on 64-bit platforms, when paravirtualization is enabled, does not verify that kernel mode is used to…
–
CVE-2010-4238
The vbd_create function in Xen 3.1.2, when the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5 is used, allows guest OS users to cause a denial of service (host OS panic)…
–
CVE-2010-4247
The do_block_io_op function in (1) drivers/xen/blkback/blkback.c and (2) drivers/xen/blktap/blktap.c in Xen before 3.4.0 for the Linux kernel 2.6.18, and possibly other versions,…