CVE-2018-15470 Denial of service in n/a
A malicious guest can cause unbounded memory usage in oxenstored by bypassing quota limits, leading to a system-wide denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-15470?
CVE-2018-15470 is a medium-severity denial of service vulnerability in Xen Xen, published on 17 Aug 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An issue was discovered in Xen through 4.11.x. The logic in oxenstored for handling writes depended on the order of evaluation of expressions making up a tuple. As indicated in section 7.7.3 "Operations on data structures" of the OCaml manual, the order of evaluation of subexpressions is not specified. In practice, different implementations behave differently. Thus, oxenstored may not enforce the configured quota-maxentity. This allows a malicious or buggy guest to write as many xenstore entries as it wishes, causing unbounded memory usage in oxenstored. This can lead to a system-wide DoS.
Weakness: CWE-400
Which versions are affected by CVE-2018-15470?
It affects 1 product.
Products include Xen Xen.
How do I fix CVE-2018-15470?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-15470 being exploited?
There is no known exploitation of CVE-2018-15470 in the wild and no public exploit code.
Other vulnerabilities in Xen Xen
Sources
Also known as ALPINE-CVE-2018-15470, DEBIAN-CVE-2018-15470, GHSA-9xrv-h87m-r2vc, UBUNTU-CVE-2018-15470.