Vulnerability · Published Sep 23, 2020 · Assigned by mitre
CVE-2020-25603
High 7.8
In plain English
A high-severity security flaw in the xen package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An issue was discovered in Xen through 4.14.x. There are missing memory barriers when accessing/allocating an event channel. Event channels control structures can be accessed lockless as long as the port is considered to be valid. Such a sequence is missing an appropriate memory barrier (e.g., smp_*mb()) to prevent both the compiler and CPU from re-ordering access. A malicious guest may be able to cause a hypervisor crash resulting in a Denial of Service (DoS). Information leak and privilege escalation cannot be excluded. Systems running all versions of Xen are affected. Whether a system is vulnerable will depend on the CPU and compiler used to build Xen. For all systems, the presence and the scope of the vulnerability depend on the precise re-ordering performed by the compiler used to build Xen. We have not been able to survey compilers; consequently we cannot say which compiler(s) might produce vulnerable code (with which code generation options). GCC documentation clearly suggests that re-ordering is possible. Arm systems will also be vulnerable if the CPU is able to re-order memory access. Please consult your CPU vendor. x86 systems are only vulnerable if a compiler performs re-ordering.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | xen | 4.14.0-r1 | ALPINE-CVE-2020-25603 |
| Alpine:v3.21 | xen | 4.14.0-r1 | ALPINE-CVE-2020-25603 |
| Alpine:v3.22 | xen | 4.14.0-r1 | ALPINE-CVE-2020-25603 |
| Alpine:v3.23 | xen | 4.14.0-r1 | ALPINE-CVE-2020-25603 |
| Alpine:v3.24 | xen | 4.14.0-r1 | ALPINE-CVE-2020-25603 |
| Debian:12 | xen | 4.14.0+80-gd101b417b7-1 | DEBIAN-CVE-2020-25603 |
| Debian:13 | xen | 4.14.0+80-gd101b417b7-1 | DEBIAN-CVE-2020-25603 |
| Debian:14 | xen | 4.14.0+80-gd101b417b7-1 | DEBIAN-CVE-2020-25603 |
Affected products (as reported)
References
- https://xenbits.xen.org/xsa/advisory-340.html x_refsource_MISC
- FEDORA-2020-306b84fd07 vendor-advisory, x_refsource_FEDORA
- FEDORA-2020-f668e579be vendor-advisory, x_refsource_FEDORA
- DSA-4769 vendor-advisory, x_refsource_DEBIAN
- openSUSE-SU-2020:1608 vendor-advisory, x_refsource_SUSE
- FEDORA-2020-d46fe34349 vendor-advisory, x_refsource_FEDORA
- GLSA-202011-06 vendor-advisory, x_refsource_GENTOO