PT-2020-6151 · Xen · Xen

Edwin Török · Published 2020-12-15 · Updated 2021-12-10 · CVE-2020-29486

Positive Technologies (AI Summary)

CVSS v3.1

6.0

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Xen versions prior to 4.14.x

Description The issue is related to the oxenstored process of the Xen hypervisor, which is associated with unbounded memory allocation. Exploitation of this issue can allow an attacker to cause a denial of service. In oxenstored, a node owner could give a node away, but node ownership has quota implications. Any guest can run another guest out of quota or create an unbounded number of nodes owned by dom0, thus running xenstored out of memory. A malicious guest administrator can cause a denial of service against a specific guest or against the whole host. All systems using oxenstored are vulnerable.

Recommendations For Xen versions prior to 4.14.x, consider disabling the use of oxenstored as a temporary workaround until a patch is available. Restrict access to the xenstore nodes to minimize the risk of exploitation. Avoid using the oxenstored process in the upstream Xen distribution if the Ocaml compiler is available, and instead use C xenstored, which is not vulnerable.

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BDU:2021-03185

CVE-2020-29486

DSA-4812-1

Affected Products

Xen

References · 24

• https://osv.dev/vulnerability/DEBIAN-CVE-2020-29486 · Vendor Advisory
• https://xenbits.xenproject.org/xsa/advisory-352.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-29486 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/OBLV6L6Q24PPQ2CRFXDX4Q76KU776GKI · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03185 · Security Note
• https://security.gentoo.org/glsa/202107-30 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2020-29486 · Vendor Advisory
• https://debian.org/security/2020/dsa-4812 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-29486 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-29486 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-29486 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2C6M6S3CIMEBACH6O7V4H2VDANMO6TVA · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-29486 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OBLV6L6Q24PPQ2CRFXDX4Q76KU776GKI · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4812-1 · Vendor Advisory