Vulnerability · Published Sep 23, 2020 · Assigned by mitre

CVE-2020-25596

Medium 5.5

In plain English

A medium-severity security flaw in the xen package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.5Medium

Exploit odds (30 days)0.5%top 56.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

An issue was discovered in Xen through 4.14.x. x86 PV guest kernels can experience denial of service via SYSENTER. The SYSENTER instruction leaves various state sanitization activities to software. One of Xen's sanitization paths injects a #GP fault, and incorrectly delivers it twice to the guest. This causes the guest kernel to observe a kernel-privilege #GP fault (typically fatal) rather than a user-privilege #GP fault (usually converted into SIGSEGV/etc.). Malicious or buggy userspace can crash the guest kernel, resulting in a VM Denial of Service. All versions of Xen from 3.2 onwards are vulnerable. Only x86 systems are vulnerable. ARM platforms are not vulnerable. Only x86 systems that support the SYSENTER instruction in 64bit mode are vulnerable. This is believed to be Intel, Centaur, and Shanghai CPUs. AMD and Hygon CPUs are not believed to be vulnerable. Only x86 PV guests can exploit the vulnerability. x86 PVH / HVM guests cannot exploit the vulnerability.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.20	xen	4.14.0-r1	ALPINE-CVE-2020-25596
Alpine:v3.21	xen	4.14.0-r1	ALPINE-CVE-2020-25596
Alpine:v3.22	xen	4.14.0-r1	ALPINE-CVE-2020-25596
Alpine:v3.23	xen	4.14.0-r1	ALPINE-CVE-2020-25596
Alpine:v3.24	xen	4.14.0-r1	ALPINE-CVE-2020-25596
Debian:12	xen	4.14.0+80-gd101b417b7-1	DEBIAN-CVE-2020-25596
Debian:13	xen	4.14.0+80-gd101b417b7-1	DEBIAN-CVE-2020-25596
Debian:14	xen	4.14.0+80-gd101b417b7-1	DEBIAN-CVE-2020-25596

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://xenbits.xen.org/xsa/advisory-339.html x_refsource_MISC
FEDORA-2020-306b84fd07 vendor-advisory, x_refsource_FEDORA
FEDORA-2020-f668e579be vendor-advisory, x_refsource_FEDORA
DSA-4769 vendor-advisory, x_refsource_DEBIAN
openSUSE-SU-2020:1608 vendor-advisory, x_refsource_SUSE
FEDORA-2020-d46fe34349 vendor-advisory, x_refsource_FEDORA
GLSA-202011-06 vendor-advisory, x_refsource_GENTOO