Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2019-19579

EPSS 0.13% · P32
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2019-19579

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
An issue was discovered in Xen through 4.12.x allowing attackers to gain host OS privileges via DMA in a situation where an untrusted domain has access to a physical device (and assignable-add is not used), because of an incomplete fix for CVE-2019-18424. XSA-302 relies on the use of libxl's "assignable-add" feature to prepare devices to be assigned to untrusted guests. Unfortunately, this is not considered a strictly required step for device assignment. The PCI passthrough documentation on the wiki describes alternate ways of preparing devices for assignment, and libvirt uses its own ways as well. Hosts where these "alternate" methods are used will still leave the system in a vulnerable state after the device comes back from a guest. An untrusted domain with access to a physical device can DMA into host memory, leading to privilege escalation. Only systems where guests are given direct access to physical devices capable of DMA (PCI pass-through) are vulnerable. Systems which do not use PCI pass-through are not vulnerable.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Xen 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Xen是英国剑桥大学的一款开源的虚拟机监视器产品。该产品能够使不同和不兼容的操作系统运行在同一台计算机上，并支持在运行时进行迁移，保证正常运行并且避免宕机。 Xen 4.12.x及之前版本中存在安全漏洞。攻击者可借助DMA利用该漏洞获取主机操作系统权限。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
-n/a n/a -

II. Public POCs for CVE-2019-19579

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2019-19579

请登录查看更多情报信息。

Same Patch Batch · n/a · 2019-12-04 · 26 CVEs total

CVE-2019-19364Sony Catalyst Production Suite和Catalyst Browse 代码问题漏洞
CVE-2019-18850TrevorC2 信息泄露漏洞
CVE-2019-14909Red Hat Keycloak 授权问题漏洞
CVE-2019-15638COPA-DATA zenone32 zenon Editor 代码问题漏洞
CVE-2019-19555Xfig fig2dev 缓冲区错误漏洞
CVE-2018-0728Helpdesk 访问控制错误漏洞
CVE-2018-0729QNAP Systems QNAP Music Station 注入漏洞
CVE-2018-0730QNAP Systems QNAP QTS File Station 注入漏洞
CVE-2019-7201QNAP Systems QNAP NetBak Replicator 代码问题漏洞
CVE-2019-7197QNAP Systems QNAP QTS 跨站脚本漏洞
CVE-2019-18346DAViCal 跨站请求伪造漏洞
CVE-2019-18347DAViCal 跨站脚本漏洞
CVE-2019-19576verot.net class.upload 代码问题漏洞
CVE-2019-19587WSO2 Enterprise Integrator 跨站脚本漏洞
CVE-2019-19229Fronius Solar Inverter 路径遍历漏洞
CVE-2019-19228Fronius Solar Inverter 安全漏洞
CVE-2019-19133WordPress CSS Hero 跨站脚本漏洞
CVE-2019-16753Decentralized Anonymous Payment System 数据伪造问题漏洞
CVE-2019-16752Decentralized Anonymous Payment System 跨站请求伪造漏洞
CVE-2019-11216BMC Smart Reporting 代码问题漏洞

Showing top 20 of 26 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: n/a
Same vendor: n/a

V. Comments for CVE-2019-19579

No comments yet

Leave a comment