Skip to content
Fencer Intel
medium 6.5

CVE-2018-12891 json

An issue was discovered in Xen through 4.10.x.

published 8y ago modified 4mo ago also EUVD-2018-4844

cvss
6.5
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 37%
public exploits
0
none known

Summary

An issue was discovered in Xen through 4.10.x. Certain PV MMU operations may take a long time to process. For that reason Xen explicitly checks for the need to preempt the current vCPU at certain points. A few rarely taken code paths did bypass such checks. By suitably enforcing the conditions through its own page table contents, a malicious guest may cause such bypasses to be used for an unbounded number of iterations. A malicious or buggy PV guest may cause a Denial of Service (DoS) affecting the entire host. Specifically, it may prevent use of a physical CPU for an indeterminate period of time. All Xen versions from 3.4 onwards are vulnerable. Xen versions 3.3 and earlier are vulnerable to an even wider class of attacks, due to them lacking preemption checks altogether in the affected code paths. Only x86 systems are affected. ARM systems are not affected. Only multi-vCPU x86 PV guests can leverage the vulnerability. x86 HVM or PVH guests as well as x86 single-vCPU PV ones cannot leverage the vulnerability.

Patch / fix

  • xen Debian 14, Debian 13, Debian 12 4.8.3+xsa267+shim4.10.1+xsa267-1+deb9u9

debian advisories DEBIAN-CVE-2018-12891

  • xen SLES 12 SP2-BCL, OpenStack Cloud 7, Enterprise Storage 4 +2 more 4.7.6_02-43.36.1
  • xen SLES 11 SP3-LTSS, SLE Point of Sale 11 SP3 4.2.5_21-45.25.1
  • xen SLES for SAP 12 SP3, SLES 12 SP3, SLED 12 SP3 +1 more 4.9.2_08-3.35.2
  • xen SLES for SAP 11 SP4, SLES 11 SP4, SLE Software Development Kit 11 SP4 4.4.4_34-61.32.1
  • xen SLE Module for Server Applications 15, SLE Module for Basesystem 15 4.10.1_06-3.3.1
  • xen SLES for SAP 12 SP1, SLES 12 SP1-LTSS 4.5.5_24-22.52.3
  • xen SLES 12-LTSS 4.4.4_34-22.71.2

suse advisories SUSE-SU-2018:2081-2SUSE-SU-2018:2528-1SUSE-SU-2018:2081-1SUSE-SU-2018:2069-1SUSE-SU-2018:2056-1SUSE-SU-2018:2059-1

  • xen openSUSE Tumbleweed 4.15.1_01-1.2

opensuse advisories openSUSE-SU-2024:11520-1

  • xen Alpine 3.24, Alpine 3.23, Alpine 3.22 +13 more 4.11.0-r0
  • xen Alpine 3.5 4.7.6-r0
  • xen Alpine 3.6 4.8.4-r0
  • xen Alpine 3.7 4.9.3-r0
  • xen Alpine 3.8 4.10.1-r3

alpine advisories ALPINE-CVE-2018-12891

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Is CVE-2018-12891 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-12891 updated cvss 6.5

xen: preemption checks bypassed in x86 PV MM handling (XSA-264)

  • Red Hat Enterprise Linux 5 xen
    affected: no fix planned “Will not fix”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.43% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.0 6.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
NVD 2.0 4.9 AV:L/AC:L/Au:N/C:N/I:N/A:C

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.