Off-by-one in Xen



Published: 2020-11-24 | Updated: 2021-01-24
Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2020-29040
CWE-ID CWE-193
Exploitation vector Local
Public exploit N/A
Vulnerable software
Subscribe
Xen
Server applications / Virtualization software

Vendor Xen Project

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Off-by-one

EUVDB-ID: #VU49943

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2020-29040

CWE-ID: CWE-193 - Off-by-one Error

Exploit availability: No

Description

The vulnerability allows a local authenticated user to execute arbitrary code.

An issue was discovered in Xen through 4.14.x allowing x86 HVM guest OS users to cause a denial of service (stack corruption), cause a data leak, or possibly gain privileges because of an off-by-one error. NOTE: this issue is caused by an incorrect fix for CVE-2020-27671.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Xen: 4.0.0 - 4.14.1


CPE2.3 External links

http://www.openwall.com/lists/oss-security/2021/01/19/4
http://xenbits.xen.org/xsa/advisory-355.html
http://xenbits.xen.org/xsa/advisory-355.html

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###