An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service because of a bad error path in GNTTABOP_map_grant. Grant table operations are expected to return 0 for success, and a negative number for errors. Some misplaced brackets cause one error path to return 1 instead of a negative value. The grant table code in Linux treats this condition as success, and proceeds with incorrectly initialised state. A buggy or malicious guest can construct its grant table in such a way that, when a backend domain tries to map a grant, it hits the incorrect error path. This will crash a Linux based dom0 or backend domain.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade xen | Jun 16, 2020 | Apr 14, 2020 |
| Debian | — | Upgrade xen | Jul 14, 2020 | Apr 14, 2020 |
| Gentoo Linux | — | Upgrade app-emulation/xen.Upgrade app-emulation/xen-tools. | Jun 15, 2020 | Apr 14, 2020 |
| Suse | — | Upgrade xen-develUpgrade xen-libsUpgrade xen-libs-32bitUpgrade xen-toolsUpgrade xen-tools-xendomains-wait-diskUpgrade xen-tools-domUUpgrade xen-doc-htmlUpgrade xen | May 1, 2020 | Apr 14, 2020 |
| Ubuntu | — | Upgrade xen-hypervisor-4.11-arm64Upgrade libxendevicemodel1Upgrade xen-utils-4.11Upgrade xenstore-utilsUpgrade libxenevtchn1Upgrade libxengnttab1Upgrade xen-hypervisor-4.11-amd64Upgrade libxenmisc4.11Upgrade xen-utils-commonUpgrade xen-hypervisor-4.11-armhf | Sep 20, 2022 | Apr 14, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub