Vulnerability · Published Dec 19, 2024 · Assigned by XEN
CVE-2024-45819libxl leaks data to PVH guests via ACPI tables
Medium 5.5
In plain English
A medium-severity incorrect default permissions in Xen from Xen. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
PVH guests have their ACPI tables constructed by the toolstack. The construction involves building the tables in local memory, which are then copied into guest memory. While actually used parts of the local memory are filled in correctly, excess space that is being allocated is left with its prior contents.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | xen | 4.18.3-r2 | ALPINE-CVE-2024-45819 |
| Alpine:v3.21 | xen | 4.19.0-r1 | ALPINE-CVE-2024-45819 |
| Alpine:v3.22 | xen | 4.19.0-r1 | ALPINE-CVE-2024-45819 |
| Alpine:v3.23 | xen | 4.19.0-r1 | ALPINE-CVE-2024-45819 |
| Alpine:v3.24 | xen | 4.19.0-r1 | ALPINE-CVE-2024-45819 |
| Debian:12 | xen | 4.17.5+23-ga4e5191dc0-1 | DEBIAN-CVE-2024-45819 |
| Debian:12 | xen | 4.17.5+23-ga4e5191dc0-1 | DSA-5836-1 |
| Debian:13 | xen | 4.19.1-1 | DEBIAN-CVE-2024-45819 |
| Debian:14 | xen | 4.19.1-1 | DEBIAN-CVE-2024-45819 |
| Ubuntu:22.04:LTS | xen | no fix listed | UBUNTU-CVE-2024-45819 |
| Ubuntu:24.04:LTS | xen | no fix listed | UBUNTU-CVE-2024-45819 |
| Ubuntu:25.10 | xen | no fix listed | UBUNTU-CVE-2024-45819 |
| Ubuntu:26.04:LTS | xen | no fix listed | UBUNTU-CVE-2024-45819 |
| Ubuntu:26.10 | xen | no fix listed | UBUNTU-CVE-2024-45819 |
Affected products (as reported)
Weakness: CWE-276 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N