CVE-2019-18423

An issue was discovered in Xen through 4.12.x allowing ARM guest OS users to cause a denial of service via a XENMEM_add_to_physmap hypercall. p2m->max_mapped_gfn is used by the functions p2m_resolve_translation_fault() and p2m_get_entry() to sanity check guest physical frame. The rest of the code in the two functions will assume that there is a valid root table and check that with BUG_ON(). The function p2m_get_root_pointer() will ignore the unused top bits of a guest physical frame. This means that the function p2m_set_entry() will alias the frame. However, p2m->max_mapped_gfn will be updated using the original frame. It would be possible to set p2m->max_mapped_gfn high enough to cover a frame that would lead p2m_get_root_pointer() to return NULL in p2m_get_entry() and p2m_resolve_translation_fault(). Additionally, the sanity check on p2m->max_mapped_gfn is off-by-one allowing "highest mapped + 1" to be considered valid. However, p2m_get_root_pointer() will return NULL. The problem could be triggered with a specially crafted hypercall XENMEM_add_to_physmap{, _batch} followed by an access to an address (via hypercall or direct access) that passes the sanity check but cause p2m_get_root_pointer() to return NULL. A malicious guest administrator may cause a hypervisor crash, resulting in a Denial of Service (DoS). Xen version 4.8 and newer are vulnerable. Only Arm systems are vulnerable. x86 systems are not affected.

• CWE-193

• http://www.openwall.com/lists/oss-security/2019/10/31/4Mailing List, Patch, Third Party Advisory
• http://xenbits.xen.org/xsa/advisory-301.htmlPatch, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2BQKX7M2RHCWDBKNPX4KEBI3MJIH6AYZ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5WWPW4BSZDDW7VHU427XTVXV7ROOFFW/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IZYATWNUGHRBG6I3TC24YHP5Y3J7I6KH/
• https://seclists.org/bugtraq/2020/Jan/21Mailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202003-56Third Party Advisory
• https://www.debian.org/security/2020/dsa-4602Third Party Advisory
• http://www.openwall.com/lists/oss-security/2019/10/31/4Mailing List, Patch, Third Party Advisory
• http://xenbits.xen.org/xsa/advisory-301.htmlPatch, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2BQKX7M2RHCWDBKNPX4KEBI3MJIH6AYZ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5WWPW4BSZDDW7VHU427XTVXV7ROOFFW/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IZYATWNUGHRBG6I3TC24YHP5Y3J7I6KH/
• https://seclists.org/bugtraq/2020/Jan/21Mailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202003-56Third Party Advisory
• https://www.debian.org/security/2020/dsa-4602Third Party Advisory

Published

Oct 31, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-18418clonos.php in ClonOS WEB control panel 19.09 allows remote a…9.8
• CVE-2019-18419A cross-site scripting (XSS) vulnerability in index.php in C…6.1
• CVE-2019-1842A vulnerability in the Secure Shell (SSH) authentication fun…5.4
• CVE-2019-18420An issue was discovered in Xen through 4.12.x allowing x86 P…6.5
• CVE-2019-18421An issue was discovered in Xen through 4.12.x allowing x86 P…7.5
• CVE-2019-18422An issue was discovered in Xen through 4.12.x allowing ARM g…8.8
• CVE-2019-18424An issue was discovered in Xen through 4.12.x allowing attac…6.8
• CVE-2019-18425An issue was discovered in Xen through 4.12.x allowing 32-bi…9.8
• CVE-2019-18426A vulnerability in WhatsApp Desktop versions prior to 0.3.93…8.2
• CVE-2019-1843A vulnerability in the web-based management interface of the…8.6
• CVE-2019-1844A vulnerability in certain attachment detection mechanisms o…5.3
• CVE-2019-18446An issue was discovered in GitLab Community and Enterprise E…4.3