cbcvebase.
CVE-2020-29567
published 2020-12-15

CVE-2020-29567: An issue was discovered in Xen 4.14.x. When moving IRQs between CPUs to distribute the load of IRQ handling, IRQ vectors are dynamically allocated and…

PriorityP422medium6.2CVSS 3.1
AVLACLPRNUINSUCNINAH
EPSS
0.36%
28.3th percentile
An issue was discovered in Xen 4.14.x. When moving IRQs between CPUs to distribute the load of IRQ handling, IRQ vectors are dynamically allocated and de-allocated on the relevant CPUs. De-allocation has to happen when certain constraints are met. If these conditions are not met when first checked, the checking CPU may send an interrupt to itself, in the expectation that this IRQ will be delivered only after the condition preventing the cleanup has cleared. For two specific IRQ vectors, this expectation was violated, resulting in a continuous stream of self-interrupts, which renders the CPU effectively unusable. A domain with a passed through PCI device can cause lockup of a physical CPU, resulting in a Denial of Service (DoS) to the entire host. Only x86 systems are vulnerable. Arm systems are not vulnerable. Only guests with physical PCI devices passed through to them can exploit the vulnerability.

Affected

7 ranges
VendorProductVersion rangeFixed in
debianxen< xen 4.14.0+88-g1d1d1f5391-1 (bookworm)xen 4.14.0+88-g1d1d1f5391-1 (bookworm)
fedoraprojectfedora——
xenxen<= 4.14.0—
xenxen>= 0 < 4.14.0+88-g1d1d1f5391-14.14.0+88-g1d1d1f5391-1
xenxen>= 0 < 4.14.0+88-g1d1d1f5391-14.14.0+88-g1d1d1f5391-1
xenxen>= 0 < 4.14.0+88-g1d1d1f5391-14.14.0+88-g1d1d1f5391-1
xenxen>= 0 < 4.14.0+88-g1d1d1f5391-14.14.0+88-g1d1d1f5391-1

CVSS provenance

nvdv3.16.2MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.04.9MEDIUMAV:L/AC:L/Au:N/C:N/I:N/A:C
osv6.2MEDIUM
vendor_debian6.2MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.