CVE-2020-27674 — Out-of-bounds Write in XEN

CWE-787 — Out-of-bounds WriteCWE-772 — Missing Release of Resource after Effective LifetimeCWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer7 documents6 sources
Severity
5.3MEDIUMNVD
EPSS
0.1%
top 77.91%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
XENDebian XENDebian Linux+1 more
Timeline
PublishedOct 22
Latest updateMay 24

Description

An issue was discovered in Xen through 4.14.x allowing x86 PV guest OS users to gain guest OS privileges by modifying kernel memory contents, because invalidation of TLB entries is mishandled during use of an INVLPG-like attack technique.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LExploitability: 1.8 | Impact: 3.4

Affected Packages3 packages

▶debiandebian/xen< xen 4.14.0+80-gd101b417b7-1 (bookworm)
▶Debianxen/xen< 4.14.0+80-gd101b417b7-1+3
▶NVDxen/xen4.14.0

Also affects: Debian Linux 10.0, Fedora 31, 32, 33

Patches

Patch: xenbits.xen.org ↗Patch: xenbits.xen.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-qwpw-7q7c-x5jq: An issue was discovered in Xen through 4↗2022-05-24
▶
OSV
CVE-2020-27674: An issue was discovered in Xen through 4↗2020-10-22
▶

📋Vendor Advisories

2
Red Hat
xen: x86 PV guest INVLPG-like flushes may leave stale TLB entries (XSA-286)↗2020-10-20
▶
Debian
CVE-2020-27674: xen - An issue was discovered in Xen through 4.14.x allowing x86 PV guest OS users to ...↗2020
▶

💬Community

2
Bugzilla
CVE-2020-27674 xen: x86 PV guest INVLPG-like flushes may leave stale TLB entries (XSA-286)↗2020-10-23
▶
Bugzilla
CVE-2020-27674 xen: x86 PV guest INVLPG-like flushes may leave stale TLB entries (XSA-286) [fedora-all]↗2020-10-23
▶