Bug 1897145 (CVE-2020-28368)
| Summary: | CVE-2020-28368 xen: information leak via power sidechannel | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Guilherme de Almeida Suckevicz <gsuckevi> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED WONTFIX | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | acaringi, ailan, bhu, bmasney, brdeoliv, dhoward, drjones, dvlasenk, fhrbata, hkrzesin, imammedo, jforbes, jshortt, jstancek, knoel, m.a.young, mrezanin, nmurray, pbonzini, ptalbert, robinlee.sysu, rvrbovsk, vkuznets, walters, xen-maint |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
A flaw was found in Xen where access to power/energy monitoring interfaces was not properly restricted to privileged software. This flaw allows an unprivileged guest administrator to create covert channels and infer the operations or data used by other contexts within the system, such as AES keys or additional sensitive information. The highest threat from this vulnerability is to confidentiality.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-11-12 17:28:34 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1897146 | ||
| Bug Blocks: | 1897147 | ||
|
Description
Guilherme de Almeida Suckevicz
2020-11-12 12:44:20 UTC
Created xen tracking bugs for this issue: Affects: fedora-all [bug 1897146] Acknowledgments: Name: the Xen project External References: https://xenbits.xen.org/xsa/advisory-351.html Statement: This flaw has been rated as having a security impact of Moderate, and is not currently planned to be addressed in future updates of Red Hat Enterprise Linux 5. Red Hat Enterprise Linux 5 is now in the Extended Life Phase of the support and maintenance life cycle. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/. Upstream fixes: --- arm: https://xenbits.xen.org/xsa/xsa351-arm.patch arm-4.11: https://xenbits.xen.org/xsa/xsa351-arm-4.11.patch --- x86-4.11-1: https://xenbits.xen.org/xsa/xsa351-x86-4.11-1.patch x86-4.11-2: https://xenbits.xen.org/xsa/xsa351-x86-4.11-2.patch --- x86-4.12-1: https://xenbits.xen.org/xsa/xsa351-x86-4.12-1.patch x86-4.12-2: https://xenbits.xen.org/xsa/xsa351-x86-4.12-2.patch --- x86-4.13-1: https://xenbits.xen.org/xsa/xsa351-x86-4.13-1.patch x86-4.13-2: https://xenbits.xen.org/xsa/xsa351-x86-4.13-2.patch --- x86-4.14-1: https://xenbits.xen.org/xsa/xsa351-x86-4.14-1.patch x86-4.14-2: https://xenbits.xen.org/xsa/xsa351-x86-4.14-2.patch Mitigation: There is no known mitigation for this flaw apart from applying the patch. This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-28368 |