#VU49942 Buffer overflow in Xen - CVE-2020-27674
Published: October 22, 2020 / Updated: January 24, 2021
Vulnerability identifier: #VU49942
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2020-27674
CWE-ID: CWE-119
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerable software:
Xen
Xen
Software vendor:
Xen Project
Xen Project
Description
The vulnerability allows a local authenticated user to read and manipulate data.
An issue was discovered in Xen through 4.14.x allowing x86 PV guest OS users to gain guest OS privileges by modifying kernel memory contents, because invalidation of TLB entries is mishandled during use of an INVLPG-like attack technique.
Remediation
Install update from vendor's website.
External links
- http://www.openwall.com/lists/oss-security/2021/01/19/5
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PZAM3LYJ5TZLSSNL3KXFILM46QKVTOUA/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U3U4LNKKXU4UP4Z5XP6TMIWSML3QODPE/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XIK57QJOVOPWH6RFRNMGOBCROBCKMDG2/
- https://security.gentoo.org/glsa/202011-06
- https://www.debian.org/security/2020/dsa-4804
- https://xenbits.xen.org/xsa/advisory-286.html