PT-2020-17000 · Xen+1 · Xen+1

Andreas Kogler + 6 · Published 2020-11-10 · Updated 2024-06-15 · CVE-2020-28368

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Xen versions through 4.14.x

Description The issue allows guest OS administrators to obtain sensitive information, such as AES keys from outside the guest, via a side-channel attack on a power/energy monitoring interface, also known as a "Platypus" attack.

Recommendations To resolve the issue, change the access control for each power/energy monitoring interface in Xen.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2020-28368

DSA-4804-1

OPENSUSE-SU-2020:2017-1

OPENSUSE-SU-2020:2030-1

OPENSUSE-SU-2020:2162-1

OPENSUSE-SU-2020:2192-1

OPENSUSE-SU-2020_2017-1

OPENSUSE-SU-2020_2030-1

OPENSUSE-SU-2020_2162-1

OPENSUSE-SU-2020_2192-1

OPENSUSE-SU-2024:11520-1

SUSE-SU-2020:14557-1

SUSE-SU-2020:3412-1

SUSE-SU-2020:3413-1

SUSE-SU-2020:3414-1

SUSE-SU-2020:3415-1

SUSE-SU-2020:3416-1

SUSE-SU-2020:3611-1

SUSE-SU-2020:3612-1

SUSE-SU-2020:3615-1

SUSE-SU-2020:3627-1

SUSE-SU-2020:3631-1

SUSE-SU-2020:3653-1

SUSE-SU-2020:3713-1

SUSE-SU-2020:3742-1

SUSE-SU-2020_14557-1

SUSE-SU-2020_3412-1

SUSE-SU-2020_3413-1

SUSE-SU-2020_3414-1

SUSE-SU-2020_3415-1

SUSE-SU-2020_3416-1

SUSE-SU-2020_3612-1

SUSE-SU-2021:1023-1

SUSE-SU-2021:1460-1

SUSE-SU-2021_1023-1

SUSE-SU-2021_1460-1

Affected Products

Suse

Xen

References · 274

• https://osv.dev/vulnerability/openSUSE-SU-2020:2030-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:3415-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:1023-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11520-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-28368 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:3414-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:3653-1 · Vendor Advisory
• https://xenbits.xen.org/xsa/advisory-351.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-28368 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:1460-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-28368 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:2192-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:14557-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:3627-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2020-28368 · Vendor Advisory