CVE-2020-29480 — Missing Authorization in XEN
Severity
2.3LOWNVD
EPSS
0.1%
top 80.92%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedDec 15
Latest updateMay 24
Description
An issue was discovered in Xen through 4.14.x. Neither xenstore implementation does any permission checks when reporting a xenstore watch event. A guest administrator can watch the root xenstored node, which will cause notifications for every created, modified, and deleted key. A guest administrator can also use the special watches, which will cause a notification every time a domain is created and destroyed. Data may include: number, type, and domids of other VMs; existence and domids of driver…
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:NExploitability: 0.8 | Impact: 1.4
Affected Packages3 packages
Also affects: Debian Linux 10.0, Fedora 32, 33
Patches
🔴Vulnerability Details
2📋Vendor Advisories
1Debian▶
CVE-2020-29480: xen - An issue was discovered in Xen through 4.14.x. Neither xenstore implementation d...↗2020