Use of uninitialized resource in Xen - CVE-2020-25595
Published: September 23, 2020
Vulnerability identifier: #VU46972
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/U:Green
CVE-ID: CVE-2020-25595
CWE-ID: CWE-908
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Xen Project
Affected software:
Xen
Xen
Detailed vulnerability description
The vulnerability allows a remote user to escalate privileges on the host operating system.
The vulnerability exists due to PCI passthrough code reading back untrusted values fromhardware registers in Xen. A remote user on a guest operating system can run a specially crafted program to obtain potentially sensitive information from memory and crash Xen or escalate privileges on the hypervisor.
The vulnerability affects x86 systems with PCI passthrough support.
How to mitigate CVE-2020-25595
Install updates from vendor's website.