Buffer overflow in Xen
CVE-2020-25599
An issue was discovered in Xen through 4.14.x. There are evtchn_reset() race conditions. Uses of EVTCHNOP_reset (potentially by a guest on itself) or XEN_DOMCTL_soft_reset (by itself covered by XSA-77) can lead to the violation of various internal assumptions. This may lead to out of bounds memory accesses or triggering of bug checks. In particular, x86 PV guests may be able to elevate their privilege to that of the host. Host and guest crashes are also possible, leading to a Denial of Service (DoS). Information leaks cannot be ruled out. All Xen versions from 4.5 onwards are vulnerable. Xen versions 4.4 and earlier are not vulnerable.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.0 (High). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.003 (18.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 19th percentile — 18.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- Xen
- Debian Linux — versions 10.0
- Fedoraproject Fedora — versions 31, 32, 33
- openSUSE Leap — versions 15.2
Weakness classification (CWE)
Public proof-of-concept exploits
References
- xenbits.xen.org/xsa/advisory-343.html (Patch, Vendor Advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- www.debian.org/security/2020/dsa-4769 (vendor-advisory, Third Party Advisory)
- lists.opensuse.org/opensuse-security-announce/2020-10/msg00008.html (vendor-advisory, Mailing List, Third Party Advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- security.gentoo.org/glsa/202011-06 (vendor-advisory, Third Party Advisory)
- www.openwall.com/lists/oss-security/2020/12/16/5 (mailing-list, Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2020-25599?
- CVE-2020-25599 is a high-severity vulnerability in Xen, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 7.0/10. Published 2020-09-23.
- How severe is CVE-2020-25599?
- High severity. CVSS v3 base score is 7.0 out of 10.
- Is CVE-2020-25599 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.