PT-2020-6034 · Xen+3 · Xen+3
Ross Lagerwall
·
Published
2020-04-14
·
Updated
2024-06-15
·
CVE-2020-11743
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Xen versions through 4.13.x
Description
The issue is related to errors in return values of the GNTTABOP map grant component in the Xen hypervisor. Exploitation of this issue can allow an attacker to cause a denial of service. The problem arises from a bad error path in GNTTABOP map grant, where grant table operations are expected to return 0 for success and a negative number for errors, but misplaced brackets cause one error path to return 1 instead of a negative value. This condition is treated as success by the grant table code in Linux, leading to incorrectly initialized state. A buggy or malicious guest can construct its grant table to hit the incorrect error path when a backend domain tries to map a grant, resulting in a crash of a Linux-based dom0 or backend domain.
Recommendations
For Xen versions through 4.13.x, consider disabling the GNTTABOP map grant operation until a patch is available to prevent potential denial of service attacks. Restrict access to grant table operations to minimize the risk of exploitation. Avoid using the grant table in a way that could trigger the incorrect error path until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
DoS
Improper Handling of Exceptional Conditions
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linuxmint
Suse
Ubuntu
Xen