CVE-2020-27670 — Insufficient Verification of Data Authenticity in XEN

CWE-345 — Insufficient Verification of Data AuthenticityCWE-567 — Unsynchronized Access to Shared Data in a Multithreaded Context8 documents7 sources
Severity
7.8HIGHNVD
EPSS
0.0%
top 86.60%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
XENDebian LinuxFedoraproject Fedora+1 more
Timeline
PublishedOct 22
Latest updateMay 24

Description

An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a denial of service (data corruption), cause a data leak, or possibly gain privileges because an AMD IOMMU page-table entry can be half-updated.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:HExploitability: 1.1 | Impact: 6.0

Affected Packages3 packages

▶Debianxen/xen< 4.14.0+80-gd101b417b7-1+3
▶NVDxen/xen4.14.0
▶NVDopensuse/leap15.1, 15.2+1

Also affects: Debian Linux 10.0, Fedora 31

Patches

Patch: xenbits.xen.org ↗Patch: xenbits.xen.org ↗Patch: xenbits.xen.org ↗

🔴Vulnerability Details

3
GHSA
GHSA-5mqq-gcv3-gmvf: An issue was discovered in Xen through 4↗2022-05-24
▶
OSV
CVE-2020-27670: An issue was discovered in Xen through 4↗2020-10-22
▶
CVEList
CVE-2020-27670: An issue was discovered in Xen through 4↗2020-10-22
▶

📋Vendor Advisories

2
Red Hat
xen: unsafe AMD IOMMU page table updates (XSA-347)↗2020-10-20
▶
Debian
CVE-2020-27670: xen - An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cau...↗2020
▶

💬Community

2
Bugzilla
CVE-2020-27670 xen: unsafe AMD IOMMU page table updates (XSA-347)↗2020-10-23
▶
Bugzilla
CVE-2020-27670 xen: unsafe AMD IOMMU page table updates (XSA-347) [fedora-all]↗2020-10-23
▶
CVE-2020-27670 — XEN vulnerability | cvebase