CVE-2020-25603HIGH
New! CVE Severity Now Using CVSS v3
The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Description
An issue was discovered in Xen through 4.14.x. There are missing memory barriers when accessing/allocating an event channel. Event channels control structures can be accessed lockless as long as the port is considered to be valid. Such a sequence is missing an appropriate memory barrier (e.g., smp_*mb()) to prevent both the compiler and CPU from re-ordering access. A malicious guest may be able to cause a hypervisor crash resulting in a Denial of Service (DoS). Information leak and privilege escalation cannot be excluded. Systems running all versions of Xen are affected. Whether a system is vulnerable will depend on the CPU and compiler used to build Xen. For all systems, the presence and the scope of the vulnerability depend on the precise re-ordering performed by the compiler used to build Xen. We have not been able to survey compilers; consequently we cannot say which compiler(s) might produce vulnerable code (with which code generation options). GCC documentation clearly suggests that re-ordering is possible. Arm systems will also be vulnerable if the CPU is able to re-order memory access. Please consult your CPU vendor. x86 systems are only vulnerable if a compiler performs re-ordering.
References
https://xenbits.xen.org/xsa/advisory-340.html
https://www.debian.org/security/2020/dsa-4769
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00008.html
Details
Source: MITRE
Published: 2020-09-23
Updated: 2021-07-21
Type: CWE-401
Risk Information
CVSS v2
Base Score: 4.6
Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P
Impact Score: 6.4
Exploitability Score: 3.9
Severity: MEDIUM
CVSS v3
Base Score: 7.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Impact Score: 5.9
Exploitability Score: 1.8
Severity: HIGH
Vulnerable Software
Configuration 1
OR
cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:* versions up to 4.14.0 (inclusive)
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 150542 | SUSE SLES11 Security Update : xen (SUSE-SU-2020:14521-1) | Nessus | SuSE Local Security Checks | medium |
| 150180 | OracleVM 3.4 : xen (OVMSA-2021-0014) | Nessus | OracleVM Local Security Checks | high |
| 144856 | Xen Missing memory barriers DoS (XSA-340) | Nessus | Misc. | high |
| 143873 | SUSE SLES12 Security Update : xen (SUSE-SU-2020:2787-1) | Nessus | SuSE Local Security Checks | medium |
| 143853 | SUSE SLES12 Security Update : xen (SUSE-SU-2020:2788-1) | Nessus | SuSE Local Security Checks | medium |
| 143805 | SUSE SLES12 Security Update : xen (SUSE-SU-2020:2822-1) | Nessus | SuSE Local Security Checks | medium |
| 143707 | SUSE SLED15 / SLES15 Security Update : xen (SUSE-SU-2020:2791-1) | Nessus | SuSE Local Security Checks | medium |
| 143685 | SUSE SLES12 Security Update : xen (SUSE-SU-2020:2786-1) | Nessus | SuSE Local Security Checks | medium |
| 143637 | SUSE SLED15 / SLES15 Security Update : xen (SUSE-SU-2020:2790-1) | Nessus | SuSE Local Security Checks | medium |
| 142854 | GLSA-202011-06 : Xen: Multiple vulnerabilities | Nessus | Gentoo Local Security Checks | high |
| 141278 | Fedora 31 : xen (2020-d46fe34349) | Nessus | Fedora Local Security Checks | medium |
| 141270 | Fedora 33 : xen (2020-306b84fd07) | Nessus | Fedora Local Security Checks | medium |
| 141168 | openSUSE Security Update : xen (openSUSE-2020-1608) | Nessus | SuSE Local Security Checks | medium |
| 141138 | Debian DSA-4769-1 : xen - security update | Nessus | Debian Local Security Checks | medium |
| 141102 | Fedora 32 : xen (2020-f668e579be) | Nessus | Fedora Local Security Checks | medium |