CVE-2020-25595

Summary

CVE	CVE-2020-25595
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2020-09-23 21:15:00 UTC
Updated	2023-11-07 03:20:00 UTC
Description	An issue was discovered in Xen through 4.14.x. The PCI passthrough code improperly uses register data. Code paths in Xen's MSI handling have been identified that act on unsanitized values read back from device hardware registers. While devices strictly compliant with PCI specifications shouldn't be able to affect these registers, experience shows that it's very common for devices to have out-of-spec "backdoor" operations that can affect the result of these reads. A not fully trusted guest may be able to crash Xen, leading to a Denial of Service (DoS) for the entire system. Privilege escalation and information leaks cannot be excluded. All versions of Xen supporting PCI passthrough are affected. Only x86 systems are vulnerable. Arm systems are not vulnerable. Only guests with passed through PCI devices may be able to leverage the vulnerability. Only systems passing through devices with out-of-spec ("backdoor") functionality can cause issues. Experience shows that such out-of-spec functionality is common; unless you have reason to believe that your device does not have such functionality, it's better to assume that it does.

Risk And Classification

Problem Types: CWE-269

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Debian	Debian Linux	10.0	All	All	All
Operating System	Debian	Debian Linux	10.0	All	All	All
Operating System	Fedoraproject	Fedora	31	All	All	All
Operating System	Fedoraproject	Fedora	32	All	All	All
Operating System	Fedoraproject	Fedora	33	All	All	All
Operating System	Fedoraproject	Fedora	32	All	All	All
Operating System	Fedoraproject	Fedora	33	All	All	All
Operating System	Opensuse	Leap	15.2	All	All	All
Operating System	Opensuse	Leap	15.2	All	All	All
Operating System	Xen	Xen	All	All	All	All

References

Reference	Source	Link	Tags
[SECURITY] Fedora 32 Update: xen-4.13.1-6.fc32 - package-announce - Fedora Mailing-Lists		lists.fedoraproject.org
Xen: Multiple vulnerabilities (GLSA 202011-06) — Gentoo security	GENTOO	security.gentoo.org
XSA-337 - Xen Security Advisories	MISC	xenbits.xen.org	Patch, Vendor Advisory
[SECURITY] Fedora 33 Update: xen-4.14.0-5.fc33 - package-announce - Fedora Mailing-Lists		lists.fedoraproject.org
[SECURITY] Fedora 31 Update: xen-4.12.3-5.fc31 - package-announce - Fedora Mailing-Lists	FEDORA	lists.fedoraproject.org
[SECURITY] Fedora 31 Update: xen-4.12.3-5.fc31 - package-announce - Fedora Mailing-Lists		lists.fedoraproject.org
[SECURITY] Fedora 32 Update: xen-4.13.1-6.fc32 - package-announce - Fedora Mailing-Lists	FEDORA	lists.fedoraproject.org	Third Party Advisory
[security-announce] openSUSE-SU-2020:1608-1: important: Security update	SUSE	lists.opensuse.org	Third Party Advisory
Debian -- Security Information -- DSA-4769-1 xen	DEBIAN	www.debian.org	Third Party Advisory
[SECURITY] Fedora 33 Update: xen-4.14.0-5.fc33 - package-announce - Fedora Mailing-Lists	FEDORA	lists.fedoraproject.org	Third Party Advisory
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

198943 Ubuntu Security Notification for Xen Vulnerabilities (USN-5617-1)
500792 Alpine Linux Security Update for xen
501512 Alpine Linux Security Update for xen
504536 Alpine Linux Security Update for xen