PT-2020-6152 · Xen+1 · Xen+1
Julien Grall
·
Published
2020-12-15
·
Updated
2024-06-15
·
CVE-2020-29571
CVSS v3.1
6.2
Medium
| Vector | AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Xen versions prior to 4.14.x
Description
A bounds check common to most operation time functions specific to FIFO event channels depends on the CPU observing consistent state. While the producer side uses appropriately ordered writes, the consumer side isn't protected against re-ordered reads, and may hence end up de-referencing a NULL pointer. Malicious or buggy guest kernels can mount a Denial of Service (DoS) attack affecting the entire system. Only Arm systems may be vulnerable. Whether a system is vulnerable depends on the specific CPU. x86 systems are not vulnerable.
Recommendations
For Xen versions prior to 4.14.x, consider disabling the FIFO event channels functionality as a temporary workaround to minimize the risk of exploitation. Restrict access to the vulnerable operation time functions to prevent malicious or buggy guest kernels from mounting a Denial of Service (DoS) attack.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
DoS
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Suse
Xen