Buffer overflow in Xen

CVE-2020-25599

An issue was discovered in Xen through 4.14.x. There are evtchn_reset() race conditions. Uses of EVTCHNOP_reset (potentially by a guest on itself) or XEN_DOMCTL_soft_reset (by itself covered by XSA-77) can lead to the violation of various internal assumptions. This may lead to out of bounds memory accesses or triggering of bug checks. In particular, x86 PV guests may be able to elevate their privilege to that of the host. Host and guest crashes are also possible, leading to a Denial of Service (DoS). Information leaks cannot be ruled out. All Xen versions from 4.5 onwards are vulnerable. Xen versions 4.4 and earlier are not vulnerable.

Vulnerability class: Buffer Overflow

EPSS: 0.003 (20.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.0 (High). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Weakness classification (CWE)

Public proof-of-concept exploits

References

  • cve@mitre.org (Patch, x_refsource_MISC, Vendor Advisory)
  • cve@mitre.org (x_refsource_FEDORA, vendor-advisory)
  • cve@mitre.org (x_refsource_FEDORA, vendor-advisory)
  • cve@mitre.org (vendor-advisory, Third Party Advisory, x_refsource_DEBIAN)
  • cve@mitre.org (vendor-advisory, Mailing List, Third Party Advisory, x_refsource_SUSE)
  • cve@mitre.org (x_refsource_FEDORA, vendor-advisory)
  • cve@mitre.org (vendor-advisory, Third Party Advisory, x_refsource_GENTOO)
  • cve@mitre.org (mailing-list, x_refsource_MLIST, Mailing List, Third Party Advisory)

Frequently asked questions

What is CVE-2020-25599?
CVE-2020-25599 is a high-severity vulnerability in Xen, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 7.0/10. Published 2020-09-23.
How severe is CVE-2020-25599?
High severity. CVSS v3 base score is 7.0 out of 10.
Is CVE-2020-25599 known to be exploited?
1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.