Candidate: CVE-2019-19582
PublicDate: 2019-12-11 18:16:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19582
 https://xenbits.xen.org/xsa/advisory-307.html
Description:
 An issue was discovered in Xen through 4.12.x allowing x86 guest OS users
 to cause a denial of service (infinite loop) because certain bit iteration
 is mishandled. In a number of places bitmaps are being used by the
 hypervisor to track certain state. Iteration over all bits involves
 functions which may misbehave in certain corner cases: On x86 accesses to
 bitmaps with a compile time known size of 64 may incur undefined behavior,
 which may in particular result in infinite loops. A malicious guest may
 cause a hypervisor crash or hang, resulting in a Denial of Service (DoS).
 All versions of Xen are vulnerable. x86 systems with 64 or more nodes are
 vulnerable (there might not be any such systems that Xen would run on). x86
 systems with less than 64 nodes are not vulnerable.
Ubuntu-Description:
Notes:
 mdeslaur> hypervisor packages are in universe. For
 mdeslaur> issues in the hypervisor, add appropriate
 mdeslaur> tags to each section, ex:
 mdeslaur> Tags_xen: universe-binary
Mitigation:
Bugs:
Priority: medium
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H [6.5 MEDIUM]

Patches_xen:
Tags_xen: universe-binary
upstream_xen: needs-triage
precise/esm_xen: DNE
trusty_xen: ignored (out of standard support)
trusty/esm_xen: DNE
xenial_xen: ignored (end of standard support, was needs-triage)
esm-infra/xenial_xen: needs-triage
bionic_xen: needs-triage
disco_xen: ignored (reached end-of-life)
eoan_xen: ignored (reached end-of-life)
focal_xen: not-affected (4.11.3+24-g14b62ab3e5-1ubuntu1)
groovy_xen: not-affected (4.11.3+24-g14b62ab3e5-1ubuntu1)
hirsute_xen: not-affected (4.11.3+24-g14b62ab3e5-1ubuntu1)
impish_xen: not-affected (4.11.3+24-g14b62ab3e5-1ubuntu1)
jammy_xen: not-affected (4.11.3+24-g14b62ab3e5-1ubuntu1)
devel_xen: not-affected (4.11.3+24-g14b62ab3e5-1ubuntu1)