CVE-2019-18425

An issue was discovered in Xen through 4.12.x allowing 32-bit PV guest OS users to gain guest OS privileges by installing and using descriptors. There is missing descriptor table limit checking in x86 PV emulation. When emulating certain PV guest operations, descriptor table accesses are performed by the emulating code. Such accesses should respect the guest specified limits, unless otherwise guaranteed to fail in such a case. Without this, emulation of 32-bit guest user mode calls through call gates would allow guest user mode to install and then use descriptors of their choice, as long as the guest kernel did not itself install an LDT. (Most OSes don't install any LDT by default). 32-bit PV guest user mode can elevate its privileges to that of the guest kernel. Xen versions from at least 3.2 onwards are affected. Only 32-bit PV guest user mode can leverage this vulnerability. HVM, PVH, as well as 64-bit PV guests cannot leverage this vulnerability. Arm systems are unaffected.

• CWE-269

• http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00037.htmlMailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2019/10/31/2Mailing List, Third Party Advisory
• http://xenbits.xen.org/xsa/advisory-298.htmlPatch, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2BQKX7M2RHCWDBKNPX4KEBI3MJIH6AYZ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5WWPW4BSZDDW7VHU427XTVXV7ROOFFW/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IZYATWNUGHRBG6I3TC24YHP5Y3J7I6KH/
• https://seclists.org/bugtraq/2020/Jan/21Mailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202003-56Third Party Advisory
• https://www.debian.org/security/2020/dsa-4602Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00037.htmlMailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2019/10/31/2Mailing List, Third Party Advisory
• http://xenbits.xen.org/xsa/advisory-298.htmlPatch, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2BQKX7M2RHCWDBKNPX4KEBI3MJIH6AYZ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I5WWPW4BSZDDW7VHU427XTVXV7ROOFFW/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IZYATWNUGHRBG6I3TC24YHP5Y3J7I6KH/
• https://seclists.org/bugtraq/2020/Jan/21Mailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202003-56Third Party Advisory
• https://www.debian.org/security/2020/dsa-4602Third Party Advisory

Published

Oct 31, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-1842A vulnerability in the Secure Shell (SSH) authentication fun…5.4
• CVE-2019-18420An issue was discovered in Xen through 4.12.x allowing x86 P…6.5
• CVE-2019-18421An issue was discovered in Xen through 4.12.x allowing x86 P…7.5
• CVE-2019-18422An issue was discovered in Xen through 4.12.x allowing ARM g…8.8
• CVE-2019-18423An issue was discovered in Xen through 4.12.x allowing ARM g…8.8
• CVE-2019-18424An issue was discovered in Xen through 4.12.x allowing attac…6.8
• CVE-2019-18426A vulnerability in WhatsApp Desktop versions prior to 0.3.93…8.2
• CVE-2019-1843A vulnerability in the web-based management interface of the…8.6
• CVE-2019-1844A vulnerability in certain attachment detection mechanisms o…5.3
• CVE-2019-18446An issue was discovered in GitLab Community and Enterprise E…4.3
• CVE-2019-18447An issue was discovered in GitLab Community and Enterprise E…4.3
• CVE-2019-18448An issue was discovered in GitLab Community and Enterprise E…6.5