SB2021012419 - Improper Privilege Management in xen (Alpine package)
Published: January 24, 2021
Security Bulletin ID
SB2021012419
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Adjecent network
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Improper Privilege Management (CVE-ID: CVE-2020-27671)
CWE-ID: CWE-269 - Improper Privilege Management
CVSSv4: CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a local user to escalate privileges.
The vulnerability exists due to improper privilege management within the IOMMU TLB implementation. A local user on a guest OS can escalate privileges on the system by running a specially crafted application.
Remediation
Install update from vendor's website.
References
- https://git.alpinelinux.org/aports/commit/?id=b7415ec9fb42dde32333fbc1e4575f6bcf11cb32
- https://git.alpinelinux.org/aports/commit/?id=7c351cb852f0cee887b3fcb3a76be20f51350a1a
- https://git.alpinelinux.org/aports/commit/?id=b47f6b6f2e6b179714227cc362a24b0bdb78a028
- https://git.alpinelinux.org/aports/commit/?id=7335a7d4162b6694682183dfea682f282843d5f3
- https://git.alpinelinux.org/aports/commit/?id=91c8694f2fdbc9ff757dc2f658107b9a87428d10