Permissions, Privileges, and Access Controls in Xen - CVE-2020-15565

Vulnerability identifier: #VU29600

CSH Severity: Medium

CVSS v4: 8.9 [CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H]

CVE-ID: CVE-2020-15565

CWE-ID: CWE-264

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to escalate privileges on the system or perform a denial of service attack.

The vulnerability exists due to application does not properly impose security restrictions. When page tables are shared between IOMMU and CPU, changes to them require flushing of both TLBs. Furthermore, IOMMUs may be non-coherent, and hence prior to flushing IOMMU TLBs, a CPU cache also needs writing back to memory after changes were made. Such writing back of cached data was missing in particular when splitting large page mappings into smaller granularity ones. A malicious guest may be able to retain read/write DMA access to frames returned to Xen's free pool, and later reused for another purpose.

Successful exploitation of the vulnerability may allows privileges escalation on the host operating system.

Note: the vulnerability affects Intel x86 systems only.

Xen
Debian Linux
Gentoo Linux
Opensuse
Ubuntu
Fedora
xen (Alpine package)
libxengnttab1 (Ubuntu package)
xen-hypervisor-4.11-amd64 (Ubuntu package)
xen-hypervisor-4.11-armhf (Ubuntu package)
libxenmisc4.11 (Ubuntu package)
libxendevicemodel1 (Ubuntu package)
xenstore-utils (Ubuntu package)
xen-utils-4.11 (Ubuntu package)
xen-hypervisor-4.11-arm64 (Ubuntu package)
xen-utils-common (Ubuntu package)
libxenevtchn1 (Ubuntu package)
xen (Debian package)
xen
IBM Systems Director

Install updates from vendor's website.

xen (Alpine package) - update to 4.12.3-r2
libxengnttab1 (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
xen-hypervisor-4.11-amd64 (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
xen-hypervisor-4.11-armhf (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
libxenmisc4.11 (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
libxendevicemodel1 (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
xenstore-utils (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
xen-utils-4.11 (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
xen-hypervisor-4.11-arm64 (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
xen-utils-common (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
libxenevtchn1 (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
xen (Debian package) - update to 4.11.4+24-gddaaccbbab-1~deb10u1
xen - addressed in versions 4.12.3-3.fc31, 4.13.1-4.fc32

• http://www.openwall.com/lists/oss-security/2020/07/07/4
• http://xenbits.xen.org/xsa/advisory-321.html

• Multiple vulnerabilities in Xen
• OpenSUSE Linux update for xen
• OpenSUSE Linux update for xen
• Gentoo update for Xen
• Permissions, Privileges, and Access Controls in xen (Alpine package)
• Debian update for xen
• Ubuntu update for xen
• Fedora 32 update for xen
• Fedora 31 update for xen