PT-2020-16116 · Xen+3 · Xen+3

Jan Beulich + 1 · Published 2020-09-23 · Updated 2024-06-15 · CVE-2020-25599

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Xen versions 4.5 through 4.14.x

Description An issue in Xen allows for evtchn reset() race conditions, potentially leading to out of bounds memory accesses, bug checks, or information leaks. Uses of EVTCHNOP reset or XEN DOMCTL soft reset can violate internal assumptions, causing host and guest crashes, which may result in a Denial of Service (DoS). Specifically, x86 PV guests may be able to elevate their privilege to that of the host.

Recommendations For Xen versions 4.5 through 4.14.x, at the moment, there is no information about a newer version that contains a fix for this issue.

Fix

DoS

Race Condition

Buffer Overflow

Weakness Enumeration

CWE-362

CWE-119

Related Identifiers

CVE-2020-25599

DSA-4769-1

OPENSUSE-SU-2020:1608-1

OPENSUSE-SU-2020_1608-1

OPENSUSE-SU-2024:11520-1

SUSE-SU-2020:2786-1

SUSE-SU-2020:2787-1

SUSE-SU-2020:2788-1

SUSE-SU-2020:2789-1

SUSE-SU-2020:2790-1

SUSE-SU-2020:2791-1

SUSE-SU-2020:2822-1

USN-5617-1

Affected Products

Linuxmint

Suse

Ubuntu

Xen

References · 167

• https://ubuntu.com/security/CVE-2020-25602 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5617-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1608-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-25596 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11520-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:2788-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-25599 · Vendor Advisory
• https://security.gentoo.org/glsa/202011-06 · Vendor Advisory
• https://debian.org/security/2020/dsa-4769 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:2822-1 · Vendor Advisory
• https://xenbits.xen.org/xsa/advisory-343.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-25599 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-0543 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-11743 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-25604 · Vendor Advisory