CVE-2020-25599

HIGH
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

An issue was discovered in Xen through 4.14.x. There are evtchn_reset() race conditions. Uses of EVTCHNOP_reset (potentially by a guest on itself) or XEN_DOMCTL_soft_reset (by itself covered by XSA-77) can lead to the violation of various internal assumptions. This may lead to out of bounds memory accesses or triggering of bug checks. In particular, x86 PV guests may be able to elevate their privilege to that of the host. Host and guest crashes are also possible, leading to a Denial of Service (DoS). Information leaks cannot be ruled out. All Xen versions from 4.5 onwards are vulnerable. Xen versions 4.4 and earlier are not vulnerable.

References

https://xenbits.xen.org/xsa/advisory-343.html

https://lists.fedoraproject.org/archives/list/[email protected]/message/4JRXMKEMQRQYWYEPHVBIWUEAVQ3LU4FN/

https://lists.fedoraproject.org/archives/list/[email protected]/message/DA633Y3G5KX7MKRN4PFEGM3IVTJMBEOM/

https://www.debian.org/security/2020/dsa-4769

http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00008.html

https://lists.fedoraproject.org/archives/list/[email protected]/message/RJZERRBJN6E6STDCHT4JHP4MI6TKBCJE/

https://security.gentoo.org/glsa/202011-06

http://www.openwall.com/lists/oss-security/2020/12/16/5

Details

Source: MITRE

Published: 2020-09-23

Updated: 2021-07-21

Type: CWE-362

Risk Information

CVSS v2

Base Score: 4.4

Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P

Impact Score: 6.4

Exploitability Score: 3.4

Severity: MEDIUM

CVSS v3

Base Score: 7

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Impact Score: 5.9

Exploitability Score: 1

Severity: HIGH

Vulnerable Software

Configuration 1

OR

cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:* versions from 4.5.0 to 4.14.0 (inclusive)

Tenable Plugins

View all (14 total)

IDNameProductFamilySeverity
150180OracleVM 3.4 : xen (OVMSA-2021-0014)NessusOracleVM Local Security Checks
high
143873SUSE SLES12 Security Update : xen (SUSE-SU-2020:2787-1)NessusSuSE Local Security Checks
medium
143853SUSE SLES12 Security Update : xen (SUSE-SU-2020:2788-1)NessusSuSE Local Security Checks
medium
143805SUSE SLES12 Security Update : xen (SUSE-SU-2020:2822-1)NessusSuSE Local Security Checks
medium
143707SUSE SLED15 / SLES15 Security Update : xen (SUSE-SU-2020:2791-1)NessusSuSE Local Security Checks
medium
143685SUSE SLES12 Security Update : xen (SUSE-SU-2020:2786-1)NessusSuSE Local Security Checks
medium
143637SUSE SLED15 / SLES15 Security Update : xen (SUSE-SU-2020:2790-1)NessusSuSE Local Security Checks
medium
142854GLSA-202011-06 : Xen: Multiple vulnerabilitiesNessusGentoo Local Security Checks
high
141502Xen evtchn_reset() race conditions privelege escalation (XSA-339)NessusMisc.
high
141278Fedora 31 : xen (2020-d46fe34349)NessusFedora Local Security Checks
medium
141270Fedora 33 : xen (2020-306b84fd07)NessusFedora Local Security Checks
medium
141168openSUSE Security Update : xen (openSUSE-2020-1608)NessusSuSE Local Security Checks
medium
141138Debian DSA-4769-1 : xen - security updateNessusDebian Local Security Checks
medium
141102Fedora 32 : xen (2020-f668e579be)NessusFedora Local Security Checks
medium