Input validation error in Xen - CVE-2020-28368
Published: November 10, 2020 / Updated: December 2, 2020
Vulnerability identifier: #VU48756
CSH Severity: Low
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-28368
CWE-ID: CWE-20
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local privileged user to gain access to sensitive information.
Xen through 4.14.x allows guest OS administrators to obtain sensitive information (such as AES keys from outside the guest) via a side-channel attack on a power/energy monitoring interface, aka a "Platypus" attack. NOTE: there is only one logically independent fix: to change the access control for each such interface in Xen.
Affected software
Xen
Debian Linux
Fedora
xen (Alpine package)
xen (Debian package)
xen
IBM Systems Director
Debian Linux
Fedora
xen (Alpine package)
xen (Debian package)
xen
IBM Systems Director
How to mitigate CVE-2020-28368
Install update from vendor's website.
xen (Debian package) - update to 4.11.4+57-g41a822c392-1
xen - addressed in versions 4.13.2-2.fc32, 4.14.0-10.fc33, 4.14.0-12.fc33
xen - addressed in versions 4.13.2-2.fc32, 4.14.0-10.fc33, 4.14.0-12.fc33
External References
- http://www.openwall.com/lists/oss-security/2020/11/26/1
- http://xenbits.xen.org/xsa/advisory-351.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5J66QUUHXH2RR4CNCKQRGVXVSOUFRPDA/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XV23EZIMNLJN4YXRRXLQV2ALW6ZEALXV/
- https://platypusattack.com
- https://www.zdnet.com/article/new-platypus-attack-can-steal-data-from-intel-cpus/
- https://xenbits.xen.org/xsa/advisory-351.html