An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a host OS crash because of incorrect error handling in event-channel port allocation. The allocation of an event-channel port may fail for multiple reasons: (1) port is already in use, (2) the memory allocation failed, or (3) the port we try to allocate is higher than what is supported by the ABI (e.g., 2L or FIFO) used by the guest or the limit set by an administrator (max_event_channels in xl cfg). Due to the missing error checks, only (1) will be considered an error. All the other cases will provide a valid port and will result in a crash when trying to access the event channel. When the administrator configured a guest to allow more than 1023 event channels, that guest may be able to crash the host. When Xen is out-of-memory, allocation of new event channels will result in crashing the host rather than reporting an error. Xen versions 4.10 and later are affected. All architectures are affected. The default configuration, when guests are created with xl/libxl, is not vulnerable, because of the default event-channel limit.

The remote host is affected by the vulnerability described in GLSA-202007-02 (Xen: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

incorrect error handling in event channel port allocation leads to DoS [XSA-317, CVE-2020-15566] (#1854465) inverted code paths in x86 dirty VRAM tracking leads to DoS [XSA-319, CVE-2020-15563] (#1854463) xen:
insufficient cache write-back under VT-d leads to DoS [XSA-321, CVE-2020-15565] (#1854467) missing alignment check in VCPUOP_register_vcpu_info leads to DoS [XSA-327, CVE-2020-15564] (#1854458) non-atomic modification of live EPT PTE leads to DoS [XSA-328, CVE-2020-15567] (#1854464)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes the following issues :

  - CVE-2020-15563: Fixed inverted code paths in x86 dirty     VRAM tracking (bsc#1173377).

  - CVE-2020-15565: Fixed insufficient cache write-back     under VT-d (bsc#1173378).

  - CVE-2020-15566: Fixed incorrect error handling in event     channel port allocation (bsc#1173376).

  - CVE-2020-15567: Fixed non-atomic modification of live     EPT PTE (bsc#1173380).

  - CVE-2020-0543: Special Register Buffer Data Sampling     (SRBDS) aka 'CrossTalk' (bsc#1172205).

Additional upstream bug fixes (bsc#1027519)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for xen fixes the following issues :

  - CVE-2020-15563: Fixed inverted code paths in x86 dirty     VRAM tracking (bsc#1173377).

  - CVE-2020-15565: Fixed insufficient cache write-back     under VT-d (bsc#1173378).

  - CVE-2020-15566: Fixed incorrect error handling in event     channel port allocation (bsc#1173376).

  - CVE-2020-15567: Fixed non-atomic modification of live     EPT PTE (bsc#1173380).

  - CVE-2020-0543: Special Register Buffer Data Sampling     (SRBDS) aka 'CrossTalk' (bsc#1172205).

Additional upstream bug fixes (bsc#1027519)

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for xen fixes the following issues :

CVE-2020-15563: Fixed inverted code paths in x86 dirty VRAM tracking (bsc#1173377).

CVE-2020-15565: Fixed insufficient cache write-back under VT-d (bsc#1173378).

CVE-2020-15566: Fixed incorrect error handling in event channel port allocation (bsc#1173376).

CVE-2020-15567: Fixed non-atomic modification of live EPT PTE (bsc#1173380).

CVE-2020-0543: Special Register Buffer Data Sampling (SRBDS) aka 'CrossTalk' (bsc#1172205).

Additional upstream bug fixes (bsc#1027519)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes the following issues :

CVE-2020-15563: Fixed inverted code paths in x86 dirty VRAM tracking (bsc#1173377).

CVE-2020-15565: Fixed insufficient cache write-back under VT-d (bsc#1173378).

CVE-2020-15566: Fixed incorrect error handling in event channel port allocation (bsc#1173376).

CVE-2020-15567: Fixed non-atomic modification of live EPT PTE (bsc#1173380).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in denial of service, guest-to-host privilege escalation or information leaks.

ID	Name	Product	Family	Severity
165248	Ubuntu 20.04 LTS : Xen vulnerabilities (USN-5617-1)	Nessus	Ubuntu Local Security Checks	high
138925	GLSA-202007-02 : Xen: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
138864	Fedora 31 : xen (2020-76cf2b0f0a)	Nessus	Fedora Local Security Checks	high
138749	openSUSE Security Update : xen (openSUSE-2020-985)	Nessus	SuSE Local Security Checks	high
138741	openSUSE Security Update : xen (openSUSE-2020-965)	Nessus	SuSE Local Security Checks	high
138535	Fedora 32 : xen (2020-fbc13516af)	Nessus	Fedora Local Security Checks	high
138495	SUSE SLED15 / SLES15 Security Update : xen (SUSE-SU-2020:1902-1)	Nessus	SuSE Local Security Checks	high
138492	SUSE SLES12 Security Update : xen (SUSE-SU-2020:1891-1)	Nessus	SuSE Local Security Checks	high
138434	SUSE SLED15 / SLES15 Security Update : xen (SUSE-SU-2020:1889-1)	Nessus	SuSE Local Security Checks	high
138433	SUSE SLES12 Security Update : xen (SUSE-SU-2020:1887-1)	Nessus	SuSE Local Security Checks	high
138394	Debian DSA-4723-1 : xen - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2020-15566

medium

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high