PatchTheCVEacrn vulnerabilities and fixes
Recent CVEs affecting acrn, with upgrade or downgrade steps. 9 tracked.
acrn has 9 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 8. Most recent: 2021-07-02. Highest priority: CVE-2019-18844 (score 56/100).
- CVE-2021-36148 HIGH 7.8 UPGRADE An issue was discovered in ACRN before 2.5
- CVE-2021-36147 HIGH 7.5 UPGRADE An issue was discovered in ACRN before 2.5
- CVE-2021-36146 HIGH 7.5 UPGRADE ACRN before 2.5 has a devicemodel/hw/pci/xhci.c NULL Pointer Dereference for a trb pointer.
- CVE-2021-36145 HIGH 7.5 UPGRADE The Device Model in ACRN through 2.5 has a devicemodel/core/mem.c use-after-free for a freed rb_entry.
- CVE-2021-36144 HIGH 7.5 UPGRADE The polling timer handler in ACRN before 2.5 has a use-after-free for a freed virtio device, related to device
- CVE-2021-36143 HIGH 7.5 UPGRADE ACRN before 2.5 has a hw/pci/virtio/virtio.c vq_endchains NULL Pointer Dereference.
- CVE-2020-28346 HIGH 7.5 UPGRADE ACRN through 2.2 has a devicemodel/hw/pci/virtio/virtio.c NULL Pointer Dereference.
- CVE-2020-15687 HIGH 7.5 MITIGATE Missing access control restrictions in the Hypervisor component of the ACRN Project (v2.0 and v1.6.1) allow a
- CVE-2019-18844 HIGH 7.5 UPGRADE The Device Model in ACRN before 2019w25.5-140000p relies on assert calls in devicemodel/hw/pci/core.c and devi
FAQ
How do I fix acrn vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is acrn being exploited right now?
None of the tracked acrn CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which acrn CVE should I patch first?
CVE-2019-18844 currently ranks highest (56/100): The Device Model in ACRN before 2019w25.5-140000p relies on assert calls in devicemodel/hw/pci/core.c and devi.