Vulnerability · Published Jul 7, 2020 · Assigned by mitre
CVE-2020-15566
Medium 6.5
In plain English
A medium-severity security flaw in the xen package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a host OS crash because of incorrect error handling in event-channel port allocation. The allocation of an event-channel port may fail for multiple reasons: (1) port is already in use, (2) the memory allocation failed, or (3) the port we try to allocate is higher than what is supported by the ABI (e.g., 2L or FIFO) used by the guest or the limit set by an administrator (max_event_channels in xl cfg). Due to the missing error checks, only (1) will be considered an error. All the other cases will provide a valid port and will result in a crash when trying to access the event channel. When the administrator configured a guest to allow more than 1023 event channels, that guest may be able to crash the host. When Xen is out-of-memory, allocation of new event channels will result in crashing the host rather than reporting an error. Xen versions 4.10 and later are affected. All architectures are affected. The default configuration, when guests are created with xl/libxl, is not vulnerable, because of the default event-channel limit.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | xen | 4.13.1-r4 | ALPINE-CVE-2020-15566 |
| Alpine:v3.21 | xen | 4.13.1-r4 | ALPINE-CVE-2020-15566 |
| Alpine:v3.22 | xen | 4.13.1-r4 | ALPINE-CVE-2020-15566 |
| Alpine:v3.23 | xen | 4.13.1-r4 | ALPINE-CVE-2020-15566 |
| Alpine:v3.24 | xen | 4.13.1-r4 | ALPINE-CVE-2020-15566 |
| Debian:12 | xen | 4.11.4+24-gddaaccbbab-1 | DEBIAN-CVE-2020-15566 |
| Debian:13 | xen | 4.11.4+24-gddaaccbbab-1 | DEBIAN-CVE-2020-15566 |
| Debian:14 | xen | 4.11.4+24-gddaaccbbab-1 | DEBIAN-CVE-2020-15566 |
Affected products (as reported)
References
- http://xenbits.xen.org/xsa/advisory-317.html x_refsource_MISC
- [oss-security] 20200707 Xen Security Advisory 317 v3 (CVE-2020-15566) - Incorrect error handling in event channel port allocation mailing-list, x_refsource_MLIST
- DSA-4723 vendor-advisory, x_refsource_DEBIAN
- openSUSE-SU-2020:0965 vendor-advisory, x_refsource_SUSE
- FEDORA-2020-fbc13516af vendor-advisory, x_refsource_FEDORA
- openSUSE-SU-2020:0985 vendor-advisory, x_refsource_SUSE
- FEDORA-2020-76cf2b0f0a vendor-advisory, x_refsource_FEDORA
- GLSA-202007-02 vendor-advisory, x_refsource_GENTOO