CVE-2019-17345
An issue was discovered in Xen 4.8.x through 4.11.x allowing x86 PV guest OS users to cause a...
An issue was discovered in Xen 4.8.x through 4.11.x allowing x86 PV guest OS users to cause a denial of service because mishandling of failed IOMMU operations causes a bug check during the cleanup of a crashed guest.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in Xen 4.8.x through 4.11.x allowing x86 PV guest OS users to cause a denial of service because mishandling of failed IOMMU operations causes a bug check during the cleanup of a crashed guest.
- Record
CVE-2019-17345- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H - CVSS 2.0
- 4.9 Medium
AV:L/AC:L/Au:N/C:N/I:N/A:C - Updated
- 2026-11-02
CVE List No score
An issue was discovered in Xen 4.8.x through 4.11.x allowing x86 PV guest OS users to cause a denial of service because mishandling of failed IOMMU operations causes a bug check during the cleanup of a crashed guest.
- Record
CVE-2019-17345- Updated
- 2026-11-02
EUVDEUVD-2019-7756 No score
An issue was discovered in Xen 4.8.x through 4.11.x allowing x86 PV guest OS users to cause a denial of service because mishandling of failed IOMMU operations causes a bug check during the cleanup of a crashed guest.
- Record
EUVD-2019-7756- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-ph73-rj9x-9q3g
An issue was discovered in Xen 4.8.x through 4.11.x allowing x86 PV guest OS users to cause a...
An issue was discovered in Xen 4.8.x through 4.11.x allowing x86 PV guest OS users to cause a denial of service because mishandling of failed IOMMU operations causes a bug check during the cleanup of a crashed guest.
- Record
GHSA-ph73-rj9x-9q3g- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVALPINE-CVE-2019-17345
An issue was discovered in Xen 4.8.x through 4.11.x allowing x86 PV guest OS users to cause a denial of service because mishandling of failed IOMMU operations causes a bug check during the cleanup of a crashed guest.
- Record
ALPINE-CVE-2019-17345- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
An issue was discovered in Xen 4.8.x through 4.11.x allowing x86 PV guest OS users to cause a denial of service because mishandling of failed IOMMU operations causes a bug check during the cleanup of a crashed guest.
- Record
CVE-2019-17345- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2019-17345
An issue was discovered in Xen 4.8.x through 4.11.x allowing x86 PV guest OS users to cause a denial of service because mishandling of failed IOMMU operations causes a bug check during the cleanup of a crashed guest.
- Record
DEBIAN-CVE-2019-17345- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-17345
An issue was discovered in Xen 4.8.x through 4.11.x allowing x86 PV guest OS users to cause a denial of service because mishandling of failed IOMMU operations causes a bug check during the cleanup of a crashed guest.
- Record
UBUNTU-CVE-2019-17345- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H - Updated
- 2026-11-02
OSVSUSE-RU-2019:2767-1 No score
Recommended update for xen
This update for xen to version 4.10.4 fixes the following issues:
- Fixed an issue where libxenlight could not restore domain vsa6535522 on live migration (bsc#1133818).
- Fixed an HPS bug which did not allow to install Windows Server 2016 with 2 CPUs setting or above (bsc#1137717).
- Fixed an issue where libxenlight could not create new domain (bsc#1131811).
- Fixed an issue where Xen could not pre-allocate 1 shadow page (bsc#1145240).
- Fixed an issue where attached pci devices were lost after reboot (bsc#1129642).
- Fixed a segmentation fault in Libvrtd during live migration to a VM (bsc#1145774).
- Xenpvnetboot is now ported correctly to Python 3 (bsc#1138563).
- Record
SUSE-RU-2019:2767-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:2753-1 No score
Security update for xen
This update for xen to version 4.11.2 fixes the following issues:
Security issues fixed:
- CVE-2019-15890: Fixed a use-after-free in SLiRP networking implementation of QEMU emulator which could have led to Denial of Service (bsc#1149813).
- CVE-2019-12068: Fixed an issue in lsi which could lead to an infinite loop and denial of service (bsc#1146874).
- CVE-2019-14378: Fixed a heap buffer overflow in SLiRp networking implementation of QEMU emulator which could have led to execution of arbitrary code with privileges of the QEMU process (bsc#1143797).
Other issues fixed:
- Fixed an HPS bug which did not allow to install Windows Server 2016 with 2 CPUs setting or above (bsc#1137717).
- Fixed a segmentation fault in Libvrtd during live migration to a VM (bsc#1145774).
- Fixed an issue where libxenlight could not create new domain (bsc#1131811).
- Fixed an issue where attached pci devices were lost after reboot (bsc#1129642).
- Fixed an issue where Xen could not pre-allocate 1 shadow page (bsc#1145240).
- Record
SUSE-SU-2019:2753-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:2769-1 No score
Security update for xen
This update for xen fixes the following issues:
Security issues fixed:
- CVE-2019-15890: Fixed a use-after-free in SLiRP networking implementation of QEMU emulator which could have led to Denial of Service (bsc#1149813).
- CVE-2019-12068: Fixed an issue in lsi which could lead to an infinite loop and denial of service (bsc#1146874).
- CVE-2019-14378: Fixed a heap buffer overflow in SLiRp networking implementation of QEMU emulator which could have led to execution of arbitrary code with privileges of the QEMU process (bsc#1143797).
Other issue fixed:
- Fixed an issue where libxenlight could not restore domain vsa6535522 on live migration (bsc#1133818).
- Record
SUSE-SU-2019:2769-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xenAlpine:v3.9 |
4.8.0 up to 4.11.2-r0 | 4.11.2-r0 |
xenDebian:12 |
before 4.11.1+92-g6c33308a8d-1 | 4.11.1+92-g6c33308a8d-1 |
xenDebian:13 |
before 4.11.1+92-g6c33308a8d-1 | 4.11.1+92-g6c33308a8d-1 |
xenDebian:14 |
before 4.11.1+92-g6c33308a8d-1 | 4.11.1+92-g6c33308a8d-1 |
xenSUSE:Linux Enterprise Module for Basesystem 15 From an advisory covering 14 CVEs |
before 4.10.4_04-3.22.1 | 4.10.4_04-3.22.1 |
xenSUSE:Linux Enterprise Module for Server Applications 15 From an advisory covering 14 CVEs |
before 4.10.4_04-3.22.1 | 4.10.4_04-3.22.1 |
xenSUSE:Linux Enterprise Desktop 12 SP4 From an advisory covering 16 CVEs |
before 4.11.2_02-2.14.2 | 4.11.2_02-2.14.2 |
xenSUSE:Linux Enterprise Software Development Kit 12 SP4 From an advisory covering 16 CVEs |
before 4.11.2_02-2.14.2 | 4.11.2_02-2.14.2 |
xenSUSE:Linux Enterprise Server 12 SP4 From an advisory covering 16 CVEs |
before 4.11.2_02-2.14.2 | 4.11.2_02-2.14.2 |
xenSUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 16 CVEs |
before 4.11.2_02-2.14.2 | 4.11.2_02-2.14.2 |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
xenSUSE:HPE Helion OpenStack 8 From an advisory covering 16 CVEs |
before 4.9.4_04-3.56.2 | 4.9.4_04-3.56.2 |
xenSUSE:OpenStack Cloud 8 From an advisory covering 16 CVEs |
before 4.9.4_04-3.56.2 | 4.9.4_04-3.56.2 |
xenSUSE:OpenStack Cloud Crowbar 8 From an advisory covering 16 CVEs |
before 4.9.4_04-3.56.2 | 4.9.4_04-3.56.2 |
xenSUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 16 CVEs |
before 4.9.4_04-3.56.2 | 4.9.4_04-3.56.2 |
xenSUSE:Linux Enterprise Server 12 SP3-LTSS From an advisory covering 16 CVEs |
before 4.9.4_04-3.56.2 | 4.9.4_04-3.56.2 |
xenSUSE:Linux Enterprise Server 12 SP3-BCL From an advisory covering 16 CVEs |
before 4.9.4_04-3.56.2 | 4.9.4_04-3.56.2 |
xenSUSE:Enterprise Storage 5 From an advisory covering 16 CVEs |
before 4.9.4_04-3.56.2 | 4.9.4_04-3.56.2 |
xenUbuntu:18.04:LTS |
All versions, plus listed versions 4.9.0-0ubuntu34.9.0-0ubuntu44.9.2-0ubuntu1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-17345 is a medium vulnerability (CVSS 6.5) in Xen, published October 8, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 28th percentile. Fixed in xen 4.11.2-r0.
References
xenbits.xen.org/xsa/advisory-291.html
openwall.com/lists/oss-security/2019/10/25/4
debian.org/security/2020/dsa-4602
seclists.org/bugtraq/2020/Jan/21
nvd.nist.gov/vuln/detail/CVE-2019-17345
github.com/advisories/GHSA-ph73-rj9x-9q3g
Show 46 moreShow less
security.alpinelinux.org/vuln/CVE-2019-17345
security-tracker.debian.org/tracker/CVE-2019-17345
suse.com/support/update/announcement/-2019-2767/suse-ru-20192767-1
bugzilla.suse.com/1027519
ubuntu.com/security/CVE-2019-17345
cve.org/CVERecord?id=CVE-2019-17345