Resource management error in Xen - CVE-2020-25596
Published: September 23, 2020
Vulnerability identifier: #VU46979
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-25596
CWE-ID: CWE-399
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to improper management of internal resources within guest VM when processing state sanitization activities. A local user or application on the guest operating system can abuse SYSENTER to cause a crash of the guest VM.
Affected software
Xen
Gentoo Linux
Opensuse
Ubuntu
Fedora
xen (Alpine package)
xen (Debian package)
libxenevtchn1 (Ubuntu package)
libxengnttab1 (Ubuntu package)
xen-hypervisor-4.11-amd64 (Ubuntu package)
xen-hypervisor-4.11-armhf (Ubuntu package)
libxenmisc4.11 (Ubuntu package)
libxendevicemodel1 (Ubuntu package)
xenstore-utils (Ubuntu package)
xen-utils-4.11 (Ubuntu package)
xen-hypervisor-4.11-arm64 (Ubuntu package)
xen-utils-common (Ubuntu package)
xen
app-emulation/xen
app-emulation/xen-tools
IBM Systems Director
Gentoo Linux
Opensuse
Ubuntu
Fedora
xen (Alpine package)
xen (Debian package)
libxenevtchn1 (Ubuntu package)
libxengnttab1 (Ubuntu package)
xen-hypervisor-4.11-amd64 (Ubuntu package)
xen-hypervisor-4.11-armhf (Ubuntu package)
libxenmisc4.11 (Ubuntu package)
libxendevicemodel1 (Ubuntu package)
xenstore-utils (Ubuntu package)
xen-utils-4.11 (Ubuntu package)
xen-hypervisor-4.11-arm64 (Ubuntu package)
xen-utils-common (Ubuntu package)
xen
app-emulation/xen
app-emulation/xen-tools
IBM Systems Director
How to mitigate CVE-2020-25596
Install updates from vendor's website.
xen (Alpine package) - update to 4.14.0-r1
xen (Debian package) - update to 4.11.4+37-g3263f257ca-1
libxenevtchn1 (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
libxengnttab1 (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
xen-hypervisor-4.11-amd64 (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
xen-hypervisor-4.11-armhf (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
libxenmisc4.11 (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
libxendevicemodel1 (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
xenstore-utils (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
xen-utils-4.11 (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
xen-hypervisor-4.11-arm64 (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
xen-utils-common (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
xen - addressed in versions 4.12.3-5.fc31, 4.13.1-6.fc32, 4.14.0-5.fc33
app-emulation/xen - update to 4.13.2
app-emulation/xen-tools - update to 4.13.2
xen (Debian package) - update to 4.11.4+37-g3263f257ca-1
libxenevtchn1 (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
libxengnttab1 (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
xen-hypervisor-4.11-amd64 (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
xen-hypervisor-4.11-armhf (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
libxenmisc4.11 (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
libxendevicemodel1 (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
xenstore-utils (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
xen-utils-4.11 (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
xen-hypervisor-4.11-arm64 (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
xen-utils-common (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
xen - addressed in versions 4.12.3-5.fc31, 4.13.1-6.fc32, 4.14.0-5.fc33
app-emulation/xen - update to 4.13.2
app-emulation/xen-tools - update to 4.13.2