CVE-2020-29040 — Off-by-one Error in XEN

CWE-193 — Off-by-one ErrorCWE-787 — Out-of-bounds Write5 documents5 sources
Severity
8.8HIGHNVD
OSV7.8
EPSS
0.1%
top 79.96%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
XENDebian XEN
Timeline
PublishedNov 24
Latest updateMay 24

Description

An issue was discovered in Xen through 4.14.x allowing x86 HVM guest OS users to cause a denial of service (stack corruption), cause a data leak, or possibly gain privileges because of an off-by-one error. NOTE: this issue is caused by an incorrect fix for CVE-2020-27671.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HExploitability: 2.0 | Impact: 6.0

Affected Packages3 packages

▶debiandebian/xen< xen 4.14.0+88-g1d1d1f5391-1 (bookworm)
▶Debianxen/xen< 4.14.0+88-g1d1d1f5391-1+3
▶NVDxen/xen4.14.0

🔴Vulnerability Details

2
GHSA
GHSA-w3xr-26m4-xc8m: An issue was discovered in Xen through 4↗2022-05-24
▶
OSV
CVE-2020-29040: An issue was discovered in Xen through 4↗2020-11-24
▶

📋Vendor Advisories

2
Red Hat
xen: stack corruption from XSA-346 change (XSA-355)↗2020-11-24
▶
Debian
CVE-2020-29040: xen - An issue was discovered in Xen through 4.14.x allowing x86 HVM guest OS users to...↗2020
▶