PT-2020-5907 · Xen+2 · Xen+2

Julien Grall · Published 2020-07-07 · Updated 2022-09-19 · CVE-2020-15564

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Xen versions through 4.13.x

Description: An issue in Xen allows Arm guest OS users to cause a hypervisor crash due to a missing alignment check in the VCPUOP register vcpu info hypercall. This hypercall is used by a guest to register a shared region with the hypervisor, which will be mapped into Xen address space for direct access. On Arm systems, the region is accessed with instructions requiring specific alignment, but there is no check to ensure the address provided by the guest is correctly aligned. A malicious guest could cause a hypervisor crash by passing a misaligned address, resulting in a Denial of Service (DoS). Only Arm systems are vulnerable, while x86 systems are not affected.

Recommendations: For Xen versions through 4.13.x, as a temporary workaround, consider disabling the VCPUOP register vcpu info hypercall until a patch is available to prevent a malicious guest from causing a hypervisor crash. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Buffer Overflow

RCE

Weakness Enumeration

CWE-119

CWE-20

Related Identifiers

BDU:2021-02003

CVE-2020-15564

DSA-4723-1

USN-5617-1

Affected Products

Linuxmint

Ubuntu

Xen

References · 43

• https://ubuntu.com/security/CVE-2020-25602 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-25604 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5617-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2020-15564 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5617-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-25603 · Vendor Advisory
• http://openwall.com/lists/oss-security/2020/07/07/5 · Patch
• https://osv.dev/vulnerability/CVE-2020-15564 · Vendor Advisory
• https://security.gentoo.org/glsa/202007-02 · Vendor Advisory
• https://debian.org/security/2020/dsa-4723 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-15565 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15564 · Security Note
• https://ubuntu.com/security/CVE-2020-25596 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-11741 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/MXESCOVI7AVRNC7HEAMFM7PMEO6D3AUH · Vendor Advisory