CVE-2019-19582

An issue was discovered in Xen through 4.12.x allowing x86 guest OS users to cause a denial of service (infinite loop) because certain bit iteration is mishandled. In a number of places bitmaps are being used by the hypervisor to track certain state. Iteration over all bits involves functions which may misbehave in certain corner cases: On x86 accesses to bitmaps with a compile time known size of 64 may incur undefined behavior, which may in particular result in infinite loops. A malicious guest may cause a hypervisor crash or hang, resulting in a Denial of Service (DoS). All versions of Xen are vulnerable. x86 systems with 64 or more nodes are vulnerable (there might not be any such systems that Xen would run on). x86 systems with less than 64 nodes are not vulnerable.

• CWE-835

• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00011.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/34HBFTYNMQMWIO2GGK7DB6KV4M6R5YPV/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D5R73AYE53QA32KTMHUVKCX6E52CIS43/
• https://seclists.org/bugtraq/2020/Jan/21
• https://security.gentoo.org/glsa/202003-56
• https://www.debian.org/security/2020/dsa-4602
• https://xenbits.xen.org/xsa/advisory-307.htmlPatch, Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00011.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/34HBFTYNMQMWIO2GGK7DB6KV4M6R5YPV/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D5R73AYE53QA32KTMHUVKCX6E52CIS43/
• https://seclists.org/bugtraq/2020/Jan/21
• https://security.gentoo.org/glsa/202003-56
• https://www.debian.org/security/2020/dsa-4602
• https://xenbits.xen.org/xsa/advisory-307.htmlPatch, Vendor Advisory

Published

Dec 11, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-19577An issue was discovered in Xen through 4.12.x allowing x86 A…7.2
• CVE-2019-19578An issue was discovered in Xen through 4.12.x allowing x86 P…8.8
• CVE-2019-19579An issue was discovered in Xen through 4.12.x allowing attac…6.8
• CVE-2019-1958A vulnerability in the web-based management interface of Cis…8.8
• CVE-2019-19580An issue was discovered in Xen through 4.12.x allowing x86 P…6.6
• CVE-2019-19581An issue was discovered in Xen through 4.12.x allowing 32-bi…6.5
• CVE-2019-19583An issue was discovered in Xen through 4.12.x allowing x86 H…7.5
• CVE-2019-19585An issue was discovered in rConfig 3.9.3. The install script…7.8
• CVE-2019-19587In WSO2 Enterprise Integrator 6.5.0, reflected XSS occurs wh…6.1
• CVE-2019-19588The validators package 0.12.2 through 0.12.5 for Python ente…7.5
• CVE-2019-19589The Lever PDF Embedder plugin 4.4 for WordPress does not blo…9.8
• CVE-2019-1959Multiple vulnerabilities in Cisco Enterprise NFV Infrastruct…4.4