CVE-2019-18425 Privilege escalation in n/a

What is CVE-2019-18425?

CVE-2019-18425 is a critical vulnerability in Debian Debian Linux, published on 31 Oct 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in Xen through 4.12.x allowing 32-bit PV guest OS users to gain guest OS privileges by installing and using descriptors. There is missing descriptor table limit checking in x86 PV emulation. When emulating certain PV guest operations, descriptor table accesses are performed by the emulating code. Such accesses should respect the guest specified limits, unless otherwise guaranteed to fail in such a case. Without this, emulation of 32-bit guest user mode calls through call gates would allow guest user mode to install and then use descriptors of their choice, as long as the guest kernel did not itself install an LDT. (Most OSes don't install any LDT by default). 32-bit PV guest user mode can elevate its privileges to that of the guest kernel. Xen versions from at least 3.2 onwards are affected. Only 32-bit PV guest user mode can leverage this vulnerability. HVM, PVH, as well as 64-bit PV guests cannot leverage this vulnerability. Arm systems are unaffected.

Weakness: CWE-269

Which versions are affected by CVE-2019-18425?

It affects 4 products.

Products include Debian Debian Linux, Fedoraproject Fedora, Opensuse Leap, Xen Xen.

How do I fix CVE-2019-18425?

Apply the vendor's patch.

Is CVE-2019-18425 being exploited?

There is no known exploitation of CVE-2019-18425 in the wild and no public exploit code.

Other vulnerabilities in Debian Debian Linux

• CVE-2015-3306 ProFTPD Improper Access Control Exploited Critical 10.0
• CVE-2025-49113 RoundCube Webmail Deserialization of Untrusted Data Exploited Critical 9.9
• CVE-2026-24061 GNU InetUtils Argument Injection Exploited Critical 9.8
• CVE-2025-39682 Linux Kernel Improper Check for Unusual or Exceptional Conditions Exploited Critical 9.8
• CVE-2024-9680 Mozilla Firefox Use-After-Free Exploited Critical 9.8

All Debian Debian Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2019-18425, DEBIAN-CVE-2019-18425, GHSA-wfcx-xxhx-657g, UBUNTU-CVE-2019-18425.