Off-by-one in Xen

Published: 2020-11-24 | Updated: 2021-01-24
Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2020-29040
Exploitation vector Local
Public exploit N/A
Vulnerable software
Server applications / Virtualization software

Vendor Xen Project

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Off-by-one

EUVDB-ID: #VU49943

Risk: Low


CVE-ID: CVE-2020-29040

CWE-ID: CWE-193 - Off-by-one Error

Exploit availability: No


The vulnerability allows a local authenticated user to execute arbitrary code.

An issue was discovered in Xen through 4.14.x allowing x86 HVM guest OS users to cause a denial of service (stack corruption), cause a data leak, or possibly gain privileges because of an off-by-one error. NOTE: this issue is caused by an incorrect fix for CVE-2020-27671.


Install update from vendor's website.

Vulnerable software versions

Xen: 4.0.0 - 4.14.1

CPE2.3 External links

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?