Bug 1877369 (CVE-2020-25595) - CVE-2020-25595 xen: PCI passthrough code reading back hardware registers (XSA-337)
Summary: CVE-2020-25595 xen: PCI passthrough code reading back hardware registers (XSA...
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2020-25595
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1881587
Blocks: 1877386
TreeView+ depends on / blocked
 
Reported: 2020-09-09 13:17 UTC by Guilherme de Almeida Suckevicz
Modified: 2021-02-16 19:17 UTC (History)
25 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in Xen. Code paths in Xen's MSI handling have been identified which act on unsanitized values read back from device hardware registers. A guest that is not fully trusted may be able to crash Xen, leading to a denial of service (DoS) for the entire system. Privilege escalation and information leaks cannot be excluded. The highest threat from this vulnerability is to system availability.
Clone Of:
Environment:
Last Closed: 2020-09-22 20:41:08 UTC


Attachments (Terms of Use)

Description Guilherme de Almeida Suckevicz 2020-09-09 13:17:32 UTC
Code paths in Xen's MSI handling have been identified which act on unsanitized values read back from device hardware registers. While devices strictly compliant with PCI specifications shouldn't be able to affect these registers, experience shows that it's very common for devices to have out-of-spec "backdoor" operations which can affect the result of these reads.

Comment 1 Guilherme de Almeida Suckevicz 2020-09-09 13:21:22 UTC
Acknowledgments:

Name: the Xen project

Comment 2 Mauro Matteo Cascella 2020-09-15 15:42:36 UTC
Statement:

Only guests with passed-through PCI devices may be able to leverage this vulnerability. Additionally, only x86 systems are vulnerable. ARM systems are not affected by this flaw.

This flaw has been rated as having a security impact of Moderate, and is not currently planned to be addressed in future updates of Red Hat Enterprise Linux 5. Red Hat Enterprise Linux 5 is now in Extended Life Phase of the support and maintenance life cycle. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Comment 3 Mauro Matteo Cascella 2020-09-15 15:42:39 UTC
Mitigation:

Avoid pass-through of physical devices to untrusted guests.

Comment 4 Mauro Matteo Cascella 2020-09-22 17:54:57 UTC
Created xen tracking bugs for this issue:

Affects: fedora-all [bug 1881587]

Comment 5 Product Security DevOps Team 2020-09-22 20:41:08 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-25595

Comment 6 Mauro Matteo Cascella 2020-09-23 07:33:53 UTC
External References:

https://xenbits.xen.org/xsa/advisory-337.html


Note You need to log in before you can comment on or make changes to this bug.