CVE-2018-12892
Malicious guest administrators or (in some situations) users may be able to write to supposedly read-only disk images.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.52%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
An issue was discovered in Xen 4.7 through 4.10.x. libxl fails to pass the readonly flag to qemu when setting up a SCSI disk, due to what was probably an erroneous merge conflict resolution. Malicious guest administrators or (in some situations) users may be able to write to supposedly read-only disk images. Only emulated SCSI disks (specified as "sd" in the libxl disk configuration, or an equivalent) are affected. IDE disks ("hd") are not affected (because attempts to make them readonly are rejected). Additionally, CDROM devices (that is, devices specified to be presented to the guest as CDROMs, regardless of the nature of the backing storage on the host) are not affected; they are always read only. Only systems using qemu-xen (rather than qemu-xen-traditional) as the device model version are vulnerable. Only systems using libxl or libxl-based toolstacks are vulnerable. (This includes xl, and libvirt with the libxl driver.) The vulnerability is present in Xen versions 4.7 and later. (In earlier versions, provided that the patch for XSA-142 has been applied, attempts to create read only disks are rejected.) If the host and guest together usually support PVHVM, the issue is exploitable only if the malicious guest administrator has control of the guest kernel or guest kernel command line.
- CVSS 3.0
- 9.9 CRITICALCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- EPSS
- 2.52% probability · 85th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- debian/debian linux · xen/xen
- Source
- cve@mitre.org
EPSS 2.5% since 27 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- http://www.openwall.com/lists/oss-security/2018/06/27/12Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/104571Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1041203Third Party Advisory, VDB Entry
- http://xenbits.xen.org/xsa/advisory-266.htmlVendor Advisory
- https://security.gentoo.org/glsa/201810-06Third Party Advisory
- https://www.debian.org/security/2018/dsa-4236Third Party Advisory
- http://www.openwall.com/lists/oss-security/2018/06/27/12Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/104571Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1041203Third Party Advisory, VDB Entry
- http://xenbits.xen.org/xsa/advisory-266.htmlVendor Advisory
- https://security.gentoo.org/glsa/201810-06Third Party Advisory
- https://www.debian.org/security/2018/dsa-4236Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.