CVE-2018-14678

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.17.12 Xen versions prior to 4.11.x

Description An issue in the Linux kernel and Xen hypervisor allows local users to cause a denial of service or possibly gain privileges. The xen failsafe callback entry point does not properly maintain the RBX register, leading to uninitialized memory usage and system crash. Within Xen, 64-bit x86 PV Linux guest OS users can trigger a guest OS crash. The vulnerability is related to insufficient access control in the xen failsafe callback function.

Recommendations For Linux kernel versions prior to 4.17.12, update to version 4.17.12 or later to resolve the issue. For Xen versions prior to 4.11.x, update to a version later than 4.11.x to resolve the issue. As a temporary workaround, consider restricting access to the xen failsafe callback entry point to minimize the risk of exploitation.