An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service because of a bad error path in GNTTABOP_map_grant. Grant table operations are expected to return 0 for success, and a negative number for errors. Some misplaced brackets cause one error path to return 1 instead of a negative value. The grant table code in Linux treats this condition as success, and proceeds with incorrectly initialised state. A buggy or malicious guest can construct its grant table in such a way that, when a backend domain tries to map a grant, it hits the incorrect error path. This will crash a Linux based dom0 or backend domain.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade xen | Jun 16, 2020 | Apr 14, 2020 |
| Debian | — | Upgrade xen | Jul 14, 2020 | Apr 14, 2020 |
| Gentoo Linux | — | Upgrade app-emulation/xen-tools.Upgrade app-emulation/xen. | Jun 15, 2020 | Apr 14, 2020 |
| Suse | — | Upgrade xen-tools-domUUpgrade xen-doc-htmlUpgrade xenUpgrade xen-tools-xendomains-wait-diskUpgrade xen-toolsUpgrade xen-libs-32bitUpgrade xen-develUpgrade xen-libs | May 1, 2020 | Apr 14, 2020 |
| Ubuntu | — | Upgrade xen-hypervisor-4.11-armhfUpgrade xen-utils-commonUpgrade libxenmisc4.11Upgrade xen-hypervisor-4.11-amd64Upgrade libxengnttab1Upgrade xen-utils-4.11Upgrade libxenevtchn1Upgrade libxendevicemodel1Upgrade xenstore-utilsUpgrade xen-hypervisor-4.11-arm64 | Sep 20, 2022 | Apr 14, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub