Race condition in Xen - CVE-2020-25599
Published: September 23, 2020
Vulnerability identifier: #VU46983
CSH Severity: High
CVSS v4: 9.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H]
CVE-ID: CVE-2020-25599
CWE-ID: CWE-362
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to escalate privileges on the system.
The vulnerability exists due to a race condition caused by uses of EVTCHNOP_reset (potentially by a guest on itself) or XEN_DOMCTL_soft_reset (by itself covered by XSA-77). A remote user on the PV guest can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the host system.
Affected software
Xen
Gentoo Linux
Opensuse
Ubuntu
Fedora
xen (Alpine package)
xen (Debian package)
libxenevtchn1 (Ubuntu package)
libxengnttab1 (Ubuntu package)
xen-hypervisor-4.11-amd64 (Ubuntu package)
xen-hypervisor-4.11-armhf (Ubuntu package)
libxenmisc4.11 (Ubuntu package)
libxendevicemodel1 (Ubuntu package)
xenstore-utils (Ubuntu package)
xen-utils-4.11 (Ubuntu package)
xen-hypervisor-4.11-arm64 (Ubuntu package)
xen-utils-common (Ubuntu package)
xen
app-emulation/xen
app-emulation/xen-tools
Gentoo Linux
Opensuse
Ubuntu
Fedora
xen (Alpine package)
xen (Debian package)
libxenevtchn1 (Ubuntu package)
libxengnttab1 (Ubuntu package)
xen-hypervisor-4.11-amd64 (Ubuntu package)
xen-hypervisor-4.11-armhf (Ubuntu package)
libxenmisc4.11 (Ubuntu package)
libxendevicemodel1 (Ubuntu package)
xenstore-utils (Ubuntu package)
xen-utils-4.11 (Ubuntu package)
xen-hypervisor-4.11-arm64 (Ubuntu package)
xen-utils-common (Ubuntu package)
xen
app-emulation/xen
app-emulation/xen-tools
How to mitigate CVE-2020-25599
Install updates from vendor's website.
xen (Alpine package) - update to 4.14.0-r1
xen (Debian package) - update to 4.11.4+37-g3263f257ca-1
libxenevtchn1 (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
libxengnttab1 (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
xen-hypervisor-4.11-amd64 (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
xen-hypervisor-4.11-armhf (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
libxenmisc4.11 (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
libxendevicemodel1 (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
xenstore-utils (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
xen-utils-4.11 (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
xen-hypervisor-4.11-arm64 (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
xen-utils-common (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
xen - addressed in versions 4.12.3-5.fc31, 4.13.1-6.fc32, 4.14.0-5.fc33
app-emulation/xen - update to 4.13.2
app-emulation/xen-tools - update to 4.13.2
xen (Debian package) - update to 4.11.4+37-g3263f257ca-1
libxenevtchn1 (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
libxengnttab1 (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
xen-hypervisor-4.11-amd64 (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
xen-hypervisor-4.11-armhf (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
libxenmisc4.11 (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
libxendevicemodel1 (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
xenstore-utils (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
xen-utils-4.11 (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
xen-hypervisor-4.11-arm64 (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
xen-utils-common (Ubuntu package) - update to 4.11.3+24-g14b62ab3e5-1ubuntu2.3
xen - addressed in versions 4.12.3-5.fc31, 4.13.1-6.fc32, 4.14.0-5.fc33
app-emulation/xen - update to 4.13.2
app-emulation/xen-tools - update to 4.13.2