PT-2020-6761 · Xen · Xen

Edwin Török · Published 2020-12-15 · Updated 2022-04-26 · CVE-2020-29479

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Xen versions prior to 4.14.x

Description The issue is related to the implementation of Ocaml xenstored in Xen, where the internal representation of the tree has special cases for the root node. Unfortunately, permissions were not checked for certain operations on the root node, allowing unprivileged guests to get and modify permissions, list, and delete the root node. This can lead to a host-wide denial of service if the whole xenstore tree is deleted. Achieving xenstore write access is also possible. All systems using oxenstored are vulnerable, while systems using C xenstored are not.

Recommendations For Xen versions prior to 4.14.x, consider disabling the use of oxenstored as a temporary workaround until a patch is available. Restrict access to the xenstore tree to minimize the risk of exploitation. Avoid using the oxenstored implementation until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2022-06104

CVE-2020-29479

DSA-4812-1

Affected Products

Xen

References · 25

• https://osv.dev/vulnerability/ALPINE-CVE-2020-29479 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-29479 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-29479 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/OBLV6L6Q24PPQ2CRFXDX4Q76KU776GKI · Vendor Advisory
• https://xenbits.xenproject.org/xsa/advisory-353.html · Vendor Advisory
• https://security.gentoo.org/glsa/202107-30 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-29479 · Security Note
• https://debian.org/security/2020/dsa-4812 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-29479 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-29479 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06104 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2C6M6S3CIMEBACH6O7V4H2VDANMO6TVA · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OBLV6L6Q24PPQ2CRFXDX4Q76KU776GKI · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4812-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-29479 · Security Note