CVE-2019-18422

An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service or gain privileges by leveraging the erroneous enabling of interrupts. Interrupts are unconditionally unmasked in exception handlers. When an exception occurs on an ARM system which is handled without changing processor level, some interrupts are unconditionally enabled during exception entry. So exceptions which occur when interrupts are masked will effectively unmask the interrupts. A malicious guest might contrive to arrange for critical Xen code to run with interrupts erroneously enabled. This could lead to data corruption, denial of service, or possibly even privilege escalation. However a precise attack technique has not been identified.

• CWE-732

• http://www.openwall.com/lists/oss-security/2019/10/31/5Mailing List, Patch, Third Party Advisory
• http://xenbits.xen.org/xsa/advisory-303.htmlPatch, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2BQKX7M2RHCWDBKNPX4KEBI3MJIH6AYZ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5WWPW4BSZDDW7VHU427XTVXV7ROOFFW/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IZYATWNUGHRBG6I3TC24YHP5Y3J7I6KH/
• https://seclists.org/bugtraq/2020/Jan/21Mailing List, Third Party Advisory
• https://www.debian.org/security/2020/dsa-4602Third Party Advisory
• http://www.openwall.com/lists/oss-security/2019/10/31/5Mailing List, Patch, Third Party Advisory
• http://xenbits.xen.org/xsa/advisory-303.htmlPatch, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2BQKX7M2RHCWDBKNPX4KEBI3MJIH6AYZ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5WWPW4BSZDDW7VHU427XTVXV7ROOFFW/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IZYATWNUGHRBG6I3TC24YHP5Y3J7I6KH/
• https://seclists.org/bugtraq/2020/Jan/21Mailing List, Third Party Advisory
• https://www.debian.org/security/2020/dsa-4602Third Party Advisory

Published

Oct 31, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-18417Sourcecodester Restaurant Management System 1.0 allows an au…8.8
• CVE-2019-18418clonos.php in ClonOS WEB control panel 19.09 allows remote a…9.8
• CVE-2019-18419A cross-site scripting (XSS) vulnerability in index.php in C…6.1
• CVE-2019-1842A vulnerability in the Secure Shell (SSH) authentication fun…5.4
• CVE-2019-18420An issue was discovered in Xen through 4.12.x allowing x86 P…6.5
• CVE-2019-18421An issue was discovered in Xen through 4.12.x allowing x86 P…7.5
• CVE-2019-18423An issue was discovered in Xen through 4.12.x allowing ARM g…8.8
• CVE-2019-18424An issue was discovered in Xen through 4.12.x allowing attac…6.8
• CVE-2019-18425An issue was discovered in Xen through 4.12.x allowing 32-bi…9.8
• CVE-2019-18426A vulnerability in WhatsApp Desktop versions prior to 0.3.93…8.2
• CVE-2019-1843A vulnerability in the web-based management interface of the…8.6
• CVE-2019-1844A vulnerability in certain attachment detection mechanisms o…5.3