Untrusted Pointer Dereference in Xen - CVE-2020-15563

Vulnerability identifier: #VU29601

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H]

CVE-ID: CVE-2020-15563

CWE-ID: CWE-822

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to inverted code paths in x86 dirty VRAM tracking in Xen. An attacker with access to HVM guest operating system can crash the hypervisor.

Note: the vulnerability affects x86 systems only.

Xen
Debian Linux
Gentoo Linux
Opensuse
Ubuntu
Fedora
xen (Alpine package)
libxengnttab1 (Ubuntu package)
xen-hypervisor-4.11-amd64 (Ubuntu package)
xen-hypervisor-4.11-armhf (Ubuntu package)
libxenmisc4.11 (Ubuntu package)
libxendevicemodel1 (Ubuntu package)
xenstore-utils (Ubuntu package)
xen-utils-4.11 (Ubuntu package)
xen-hypervisor-4.11-arm64 (Ubuntu package)
xen-utils-common (Ubuntu package)
libxenevtchn1 (Ubuntu package)
xen (Debian package)
xen

Install updates from vendor's website.

xen (Alpine package) - update to 4.12.3-r2
libxengnttab1 (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
xen-hypervisor-4.11-amd64 (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
xen-hypervisor-4.11-armhf (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
libxenmisc4.11 (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
libxendevicemodel1 (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
xenstore-utils (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
xen-utils-4.11 (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
xen-hypervisor-4.11-arm64 (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
xen-utils-common (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
libxenevtchn1 (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
xen (Debian package) - update to 4.11.4+24-gddaaccbbab-1~deb10u1
xen - addressed in versions 4.12.3-3.fc31, 4.13.1-4.fc32

• http://www.openwall.com/lists/oss-security/2020/07/07/3
• http://xenbits.xen.org/xsa/advisory-319.html

• Multiple vulnerabilities in Xen
• OpenSUSE Linux update for xen
• OpenSUSE Linux update for xen
• Gentoo update for Xen
• Untrusted Pointer Dereference in xen (Alpine package)
• Debian update for xen
• Ubuntu update for xen
• Fedora 32 update for xen
• Fedora 31 update for xen