Buffer overflow in Xen - CVE-2020-27674

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU49942

Buffer overflow in Xen - CVE-2020-27674

Published: October 22, 2020 / Updated: January 24, 2021


Vulnerability identifier: #VU49942
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-27674
CWE-ID: CWE-119
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local authenticated user to read and manipulate data.

An issue was discovered in Xen through 4.14.x allowing x86 PV guest OS users to gain guest OS privileges by modifying kernel memory contents, because invalidation of TLB entries is mishandled during use of an INVLPG-like attack technique.


Affected software

Xen
Gentoo Linux
Debian Linux
Fedora
xen (Alpine package)
xen (Debian package)
xen
app-emulation/xen
app-emulation/xen-tools
IBM Systems Director

How to mitigate CVE-2020-27674

Install update from vendor's website.

xen (Debian package) - update to 4.11.4+57-g41a822c392-1
xen - addressed in versions 4.12.3-7.fc31, 4.12.3-8.fc31, 4.13.1-8.fc32, 4.13.2-1.fc32, 4.14.0-7.fc33, 4.14.0-9.fc33
app-emulation/xen - update to 4.13.2
app-emulation/xen-tools - update to 4.13.2

External References

Related Security Bulletins