Bug 1877369 (CVE-2020-25595)
| Summary: | CVE-2020-25595 xen: PCI passthrough code reading back hardware registers (XSA-337) | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Guilherme de Almeida Suckevicz <gsuckevi> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED WONTFIX | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | acaringi, ailan, bhu, bmasney, brdeoliv, dhoward, drjones, dvlasenk, fhrbata, hkrzesin, imammedo, jforbes, jshortt, jstancek, knoel, m.a.young, mrezanin, nmurray, pbonzini, ptalbert, robinlee.sysu, rvrbovsk, security-response-team, vkuznets, xen-maint |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
A flaw was found in Xen. Code paths in Xen's MSI handling have been identified which act on unsanitized values read back from device hardware registers. A guest that is not fully trusted may be able to crash Xen, leading to a denial of service (DoS) for the entire system. Privilege escalation and information leaks cannot be excluded. The highest threat from this vulnerability is to system availability.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-09-22 20:41:08 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1881587 | ||
| Bug Blocks: | 1877386 | ||
|
Description
Guilherme de Almeida Suckevicz
2020-09-09 13:17:32 UTC
Acknowledgments: Name: the Xen project Statement: Only guests with passed-through PCI devices may be able to leverage this vulnerability. Additionally, only x86 systems are vulnerable. ARM systems are not affected by this flaw. This flaw has been rated as having a security impact of Moderate, and is not currently planned to be addressed in future updates of Red Hat Enterprise Linux 5. Red Hat Enterprise Linux 5 is now in Extended Life Phase of the support and maintenance life cycle. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/. Mitigation: Avoid pass-through of physical devices to untrusted guests. Created xen tracking bugs for this issue: Affects: fedora-all [bug 1881587] This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-25595 External References: https://xenbits.xen.org/xsa/advisory-337.html |