Skip to content
Fencer Vulns
critical 9.9

CVE-2018-12892 json

An issue was discovered in Xen 4.7 through 4.10.x.

published 2018-07-02 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-4845

cvss
9.9
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.5%
EPSS 2.5% chance of exploitation in 30 days, percentile 84%
public exploits
0
none known

Summary

An issue was discovered in Xen 4.7 through 4.10.x. libxl fails to pass the readonly flag to qemu when setting up a SCSI disk, due to what was probably an erroneous merge conflict resolution. Malicious guest administrators or (in some situations) users may be able to write to supposedly read-only disk images. Only emulated SCSI disks (specified as "sd" in the libxl disk configuration, or an equivalent) are affected. IDE disks ("hd") are not affected (because attempts to make them readonly are rejected). Additionally, CDROM devices (that is, devices specified to be presented to the guest as CDROMs, regardless of the nature of the backing storage on the host) are not affected; they are always read only. Only systems using qemu-xen (rather than qemu-xen-traditional) as the device model version are vulnerable. Only systems using libxl or libxl-based toolstacks are vulnerable. (This includes xl, and libvirt with the libxl driver.) The vulnerability is present in Xen versions 4.7 and later. (In earlier versions, provided that the patch for XSA-142 has been applied, attempts to create read only disks are rejected.) If the host and guest together usually support PVHVM, the issue is exploitable only if the malicious guest administrator has control of the guest kernel or guest kernel command line.

Patch / fix

  • xen Debian 14, Debian 13, Debian 12 4.8.3+xsa267+shim4.10.1+xsa267-1+deb9u9

debian advisories DEBIAN-CVE-2018-12892

  • xen SLES 12 SP2-BCL, OpenStack Cloud 7, Enterprise Storage 4 +2 more 4.7.6_02-43.36.1
  • xen SLES for SAP 12 SP3, SLES 12 SP3, SLED 12 SP3 +1 more 4.9.2_08-3.35.2
  • xen SLE Module for Server Applications 15, SLE Module for Basesystem 15 4.10.1_06-3.3.1

suse advisories SUSE-SU-2018:2081-2SUSE-SU-2018:2081-1SUSE-SU-2018:2059-1SUSE-SU-2018:1981-1

  • xen openSUSE Tumbleweed 4.15.1_01-1.2

opensuse advisories openSUSE-SU-2024:11520-1

  • xen Alpine 3.24, Alpine 3.23, Alpine 3.22 +13 more 4.11.0-r0
  • xen Alpine 3.5 4.7.6-r0
  • xen Alpine 3.6 4.8.4-r0
  • xen Alpine 3.7 4.9.3-r0
  • xen Alpine 3.8 4.10.1-r3

alpine advisories ALPINE-CVE-2018-12892

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-12892 updated cvss 7.7

xen: libxl fails to honour readonly flag on HVM emulated SCSI disks

  • Red Hat Enterprise Linux 5 xen
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.47% chance of exploitation in the next 30 days, higher than 84% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.0 9.9 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD 2.0 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.