CVE-2020-15564Improper Restriction of Operations within the Bounds of a Memory Buffer in XEN

Severity
6.5MEDIUMNVD
OSV5.5
EPSS
0.1%
top 76.20%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedJul 7
Latest updateSep 19

Description

An issue was discovered in Xen through 4.13.x, allowing Arm guest OS users to cause a hypervisor crash because of a missing alignment check in VCPUOP_register_vcpu_info. The hypercall VCPUOP_register_vcpu_info is used by a guest to register a shared region with the hypervisor. The region will be mapped into Xen address space so it can be directly accessed. On Arm, the region is accessed with instructions that require a specific alignment. Unfortunately, there is no check that the address provide

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:HExploitability: 2.0 | Impact: 4.0

Affected Packages4 packages

debiandebian/xen< xen 4.11.4+24-gddaaccbbab-1 (bookworm)
Debianxen/xen< 4.11.4+24-gddaaccbbab-1+3
Ubuntuxen/xen< 4.11.3+24-g14b62ab3e5-1ubuntu2.3
NVDxen/xen4.8.04.13.1

Also affects: Debian Linux 10.0, Fedora 31, 32

Patches

🔴Vulnerability Details

3
OSV
xen vulnerabilities2022-09-19
GHSA
GHSA-m5jw-hjp2-vr52: An issue was discovered in Xen through 42022-05-24
OSV
CVE-2020-15564: An issue was discovered in Xen through 42020-07-07

📋Vendor Advisories

3
Ubuntu
Xen vulnerabilities2022-09-19
Red Hat
xen: missing alignment check in VCPUOP_register_vcpu_info leads to DoS (XSA-327)2020-07-07
Debian
CVE-2020-15564: xen - An issue was discovered in Xen through 4.13.x, allowing Arm guest OS users to ca...2020

💬Community

2
Bugzilla
CVE-2020-15564 xen: missing alignment check in VCPUOP_register_vcpu_info leads to DoS (XSA-327) [fedora-all]2020-07-07
Bugzilla
CVE-2020-15564 xen: missing alignment check in VCPUOP_register_vcpu_info leads to DoS (XSA-327)2020-06-26