PT-2020-16113 · Xen+3 · Xen+3
Andrew Cooper
·
Published
2020-09-23
·
Updated
2024-06-15
·
CVE-2020-25596
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Xen versions 3.2 through 4.14.x
Description
An issue in Xen allows x86 PV guest kernels to experience denial of service via the SYSENTER instruction. The SYSENTER instruction leaves various state sanitization activities to software, and one of Xen's sanitization paths incorrectly delivers a #GP fault twice to the guest, causing the guest kernel to observe a kernel-privilege #GP fault, which is typically fatal. This can be exploited by malicious or buggy userspace to crash the guest kernel, resulting in a VM Denial of Service. The issue is specific to x86 systems that support the SYSENTER instruction in 64bit mode, which includes Intel, Centaur, and Shanghai CPUs, but excludes AMD and Hygon CPUs. Only x86 PV guests can exploit the vulnerability.
Recommendations
For Xen versions 3.2 through 4.14.x, consider disabling the SYSENTER instruction in 64bit mode as a temporary workaround to minimize the risk of exploitation. Restrict access to the vulnerable x86 PV guests to prevent malicious or buggy userspace from crashing the guest kernel.
Fix
DoS
Special Elements Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linuxmint
Suse
Ubuntu
Xen