CVE-2020-15567
published 2020-07-07CVE-2020-15567: An issue was discovered in Xen through 4.13.x, allowing Intel guest OS users to gain privileges or cause a denial of service because of non-atomic modification…
PriorityP339high7.8CVSS 3.1
AVLACHPRLUINSCCHIHAH
EPSS
0.28%
19.8th percentile
An issue was discovered in Xen through 4.13.x, allowing Intel guest OS users to gain privileges or cause a denial of service because of non-atomic modification of a live EPT PTE. When mapping guest EPT (nested paging) tables, Xen would in some circumstances use a series of non-atomic bitfield writes. Depending on the compiler version and optimisation flags, Xen might expose a dangerous partially written PTE to the hardware, which an attacker might be able to race to exploit. A guest administrator or perhaps even an unprivileged guest user might be able to cause denial of service, data corruption, or privilege escalation. Only systems using Intel CPUs are vulnerable. Systems using AMD CPUs, and Arm systems, are not vulnerable. Only systems using nested paging (hap, aka nested paging, aka in this case Intel EPT) are vulnerable. Only HVM and PVH guests can exploit the vulnerability. The presence and scope of the vulnerability depends on the precise optimisations performed by the compiler used to build Xen. If the compiler generates (a) a single 64-bit write, or (b) a series of read-modify-write operations in the same order as the source code, the hypervisor is not vulnerable. For example, in one test build using GCC 8.3 with normal settings, the compiler generated multiple (unlocked) read-modify-write operations in source-code order, which did not constitute a vulnerability. We have not been able to survey compilers; consequently we cannot say which compiler(s) might produce vulnerable code (with which code-generation options). The source code clearly violates the C rules, and thus should be considered vulnerable.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | xen | < xen 4.11.4+24-gddaaccbbab-1 (bookworm) | xen 4.11.4+24-gddaaccbbab-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| opensuse | leap | — | — |
| opensuse | leap | — | — |
| xen | xen | <= 4.13.1 | — |
| xen | xen | >= 0 < 4.11.4+24-gddaaccbbab-1 | 4.11.4+24-gddaaccbbab-1 |
| xen | xen | >= 0 < 4.11.4+24-gddaaccbbab-1 | 4.11.4+24-gddaaccbbab-1 |
| xen | xen | >= 0 < 4.11.4+24-gddaaccbbab-1 | 4.11.4+24-gddaaccbbab-1 |
| xen | xen | >= 0 < 4.11.4+24-gddaaccbbab-1 | 4.11.4+24-gddaaccbbab-1 |
| xen | xen | >= 0 < 4.11.3+24-g14b62ab3e5-1ubuntu2.3 | 4.11.3+24-g14b62ab3e5-1ubuntu2.3 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
nvdv2.04.4MEDIUMAV:L/AC:M/Au:N/C:P/I:P/A:P
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Xen vulnerabilities
vendor_ubuntu·2022-09-19·CVSS 5.5
CVE-2020-25599 [MEDIUM] Xen vulnerabilities
Title: Xen vulnerabilities
Summary: Several security issues were fixed in Xen.
It was discovered that memory contents previously stored in
microarchitectural special registers after RDRAND, RDSEED, and SGX EGETKEY
read operations on Intel client and Xeon E3 processors may be briefly
exposed to processes on the same or different processor cores. A local
attacker could use this to expose sensitive information. (CVE-2020-0543)
Julien Grall discovered that Xen incorrectly handled memory barriers on
ARM-based systems. An attacker could possibly use this issue to cause a
denial of service, obtain sensitive information or escalate privileges.
(CVE-2020-11739)
Ilja Van Sprundel discovered that Xen incorrectly handled profiling of
guests. An unprivileged attacker could use this issue to obtain
Red Hat
xen: non-atomic modification of live EPT PTE leads to DoS (XSA-328)
vendor_redhat·2020-07-07·CVSS 7.8
CVE-2020-15567 [HIGH] CWE-362 xen: non-atomic modification of live EPT PTE leads to DoS (XSA-328)
xen: non-atomic modification of live EPT PTE leads to DoS (XSA-328)
An issue was discovered in Xen through 4.13.x, allowing Intel guest OS users to gain privileges or cause a denial of service because of non-atomic modification of a live EPT PTE. When mapping guest EPT (nested paging) tables, Xen would in some circumstances use a series of non-atomic bitfield writes. Depending on the compiler version and optimisation flags, Xen might expose a dangerous partially written PTE to the hardware, which an attacker might be able to race to exploit. A guest administrator or perhaps even an unprivileged guest user might be able to cause denial of service, data corruption, or privilege escalation. Only systems using Intel CPUs are vulnerable. Systems using AMD CPUs, and Arm systems, are not vulnera
Debian
CVE-2020-15567: xen - An issue was discovered in Xen through 4.13.x, allowing Intel guest OS users to ...
vendor_debian·2020·CVSS 7.8
CVE-2020-15567 [HIGH] CVE-2020-15567: xen - An issue was discovered in Xen through 4.13.x, allowing Intel guest OS users to ...
An issue was discovered in Xen through 4.13.x, allowing Intel guest OS users to gain privileges or cause a denial of service because of non-atomic modification of a live EPT PTE. When mapping guest EPT (nested paging) tables, Xen would in some circumstances use a series of non-atomic bitfield writes. Depending on the compiler version and optimisation flags, Xen might expose a dangerous partially written PTE to the hardware, which an attacker might be able to race to exploit. A guest administrator or perhaps even an unprivileged guest user might be able to cause denial of service, data corruption, or privilege escalation. Only systems using Intel CPUs are vulnerable. Systems using AMD CPUs, and Arm systems, are not vulnerable. Only systems using nested paging (hap, aka nested paging, aka in
OSV
xen vulnerabilities
osv·2022-09-19·CVSS 5.5
CVE-2020-0543 [MEDIUM] xen vulnerabilities
xen vulnerabilities
It was discovered that memory contents previously stored in
microarchitectural special registers after RDRAND, RDSEED, and SGX EGETKEY
read operations on Intel client and Xeon E3 processors may be briefly
exposed to processes on the same or different processor cores. A local
attacker could use this to expose sensitive information. (CVE-2020-0543)
Julien Grall discovered that Xen incorrectly handled memory barriers on
ARM-based systems. An attacker could possibly use this issue to cause a
denial of service, obtain sensitive information or escalate privileges.
(CVE-2020-11739)
Ilja Van Sprundel discovered that Xen incorrectly handled profiling of
guests. An unprivileged attacker could use this issue to obtain sensitive
information from other guests, cause a denial of s
GHSA
GHSA-mpwm-7x8j-q5j2: An issue was discovered in Xen through 4
ghsa_unreviewed·2022-05-24
CVE-2020-15567 [MEDIUM] CWE-362 GHSA-mpwm-7x8j-q5j2: An issue was discovered in Xen through 4
An issue was discovered in Xen through 4.13.x, allowing Intel guest OS users to gain privileges or cause a denial of service because of non-atomic modification of a live EPT PTE. When mapping guest EPT (nested paging) tables, Xen would in some circumstances use a series of non-atomic bitfield writes. Depending on the compiler version and optimisation flags, Xen might expose a dangerous partially written PTE to the hardware, which an attacker might be able to race to exploit. A guest administrator or perhaps even an unprivileged guest user might be able to cause denial of service, data corruption, or privilege escalation. Only systems using Intel CPUs are vulnerable. Systems using AMD CPUs, and Arm systems, are not vulnerable. Only systems using nested paging (hap, aka nested paging, aka in
OSV
CVE-2020-15567: An issue was discovered in Xen through 4
osv·2020-07-07·CVSS 7.8
CVE-2020-15567 [HIGH] CVE-2020-15567: An issue was discovered in Xen through 4
An issue was discovered in Xen through 4.13.x, allowing Intel guest OS users to gain privileges or cause a denial of service because of non-atomic modification of a live EPT PTE. When mapping guest EPT (nested paging) tables, Xen would in some circumstances use a series of non-atomic bitfield writes. Depending on the compiler version and optimisation flags, Xen might expose a dangerous partially written PTE to the hardware, which an attacker might be able to race to exploit. A guest administrator or perhaps even an unprivileged guest user might be able to cause denial of service, data corruption, or privilege escalation. Only systems using Intel CPUs are vulnerable. Systems using AMD CPUs, and Arm systems, are not vulnerable. Only systems using nested paging (hap, aka nested paging, aka in
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2020-15567 xen: non-atomic modification of live EPT PTE leads to DoS (XSA-328) [fedora-all]
bugzilla·2020-07-07·CVSS 7.8
CVE-2020-15567 [HIGH] CVE-2020-15567 xen: non-atomic modification of live EPT PTE leads to DoS (XSA-328) [fedora-all]
CVE-2020-15567 xen: non-atomic modification of live EPT PTE leads to DoS (XSA-328) [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple
Bugzilla
CVE-2020-15567 xen: non-atomic modification of live EPT PTE leads to DoS (XSA-328)
bugzilla·2020-06-26·CVSS 7.8
CVE-2020-15567 [HIGH] CVE-2020-15567 xen: non-atomic modification of live EPT PTE leads to DoS (XSA-328)
CVE-2020-15567 xen: non-atomic modification of live EPT PTE leads to DoS (XSA-328)
A vulnerability was found in xen, where a guest administrator or perhaps even unprivileged guest user might be able to cause denial of service, data corruption, or privilege escalation.
Discussion:
Acknowledgments:
Name: the Xen project
---
This flaw affects systems using Intel CPUs with support for nested virtualization, and only HVM and PVH guests can exploit the vulnerability (PV guests are not affected). Note that, as of Xen 4.4, nested HVM on Intel CPUs is considered "tech preview" and not recommended to be used in a production environment [1].
[1] https://wiki.xenproject.org/wiki/Nested_Virtualization_in_Xen
---
Statement:
This flaw affects systems using Intel CPUs with support for nested pag
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00024.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-07/msg00031.htmlhttp://www.openwall.com/lists/oss-security/2020/07/07/6http://xenbits.xen.org/xsa/advisory-328.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MXESCOVI7AVRNC7HEAMFM7PMEO6D3AUH/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VB3QJJZV23Z2IDYEMIHELWYSQBUEW6JP/https://security.gentoo.org/glsa/202007-02https://www.debian.org/security/2020/dsa-4723http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00024.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-07/msg00031.htmlhttp://www.openwall.com/lists/oss-security/2020/07/07/6http://xenbits.xen.org/xsa/advisory-328.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MXESCOVI7AVRNC7HEAMFM7PMEO6D3AUH/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VB3QJJZV23Z2IDYEMIHELWYSQBUEW6JP/https://security.gentoo.org/glsa/202007-02https://www.debian.org/security/2020/dsa-4723
2020-07-07
Published