Bug 1851472 (CVE-2020-15567)
| Summary: | CVE-2020-15567 xen: non-atomic modification of live EPT PTE leads to DoS (XSA-328) | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Dhananjay Arunesh <darunesh> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED NOTABUG | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | acaringi, ailan, bhu, bmasney, brdeoliv, dhoward, drjones, dvlasenk, fhrbata, gsuckevi, hkrzesin, imammedo, jforbes, jshortt, jstancek, knoel, m.a.young, mrezanin, nmurray, pbonzini, ptalbert, robinlee.sysu, rvrbovsk, security-response-team, vkuznets, xen-maint |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
A race condition flaw was found in Xen in the mapping of guest EPT tables (nested paging). Under certain circumstances, a guest user might be able to cause Denial of Service (DoS), data corruption, or privilege escalation.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-07-07 19:29:58 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1854464 | ||
| Bug Blocks: | 1851487 | ||
|
Description
Dhananjay Arunesh
2020-06-26 16:27:46 UTC
Acknowledgments: Name: the Xen project This flaw affects systems using Intel CPUs with support for nested virtualization, and only HVM and PVH guests can exploit the vulnerability (PV guests are not affected). Note that, as of Xen 4.4, nested HVM on Intel CPUs is considered "tech preview" and not recommended to be used in a production environment [1]. [1] https://wiki.xenproject.org/wiki/Nested_Virtualization_in_Xen Statement: This flaw affects systems using Intel CPUs with support for nested paging (HAP). Only HVM and PVH guests can exploit the vulnerability, PV guests are not affected by this flaw. Mitigation: Switching to shadow paging (e.g. using the `hap=0` xl domain domain configuration file parameter) will avoid exposing the vulnerability to those guests. *** Bug 1854208 has been marked as a duplicate of this bug. *** External References: https://xenbits.xen.org/xsa/advisory-328.html Created xen tracking bugs for this issue: Affects: fedora-all [bug 1854464] This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-15567 |