CVE-2020-25600

Summary

CVE	CVE-2020-25600
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2020-09-23 22:15:00 UTC
Updated	2023-11-07 03:20:00 UTC
Description	An issue was discovered in Xen through 4.14.x. Out of bounds event channels are available to 32-bit x86 domains. The so called 2-level event channel model imposes different limits on the number of usable event channels for 32-bit x86 domains vs 64-bit or Arm (either bitness) ones. 32-bit x86 domains can use only 1023 channels, due to limited space in their shared (between guest and Xen) information structure, whereas all other domains can use up to 4095 in this model. The recording of the respective limit during domain initialization, however, has occurred at a time where domains are still deemed to be 64-bit ones, prior to actually honoring respective domain properties. At the point domains get recognized as 32-bit ones, the limit didn't get updated accordingly. Due to this misbehavior in Xen, 32-bit domains (including Domain 0) servicing other domains may observe event channel allocations to succeed when they should really fail. Subsequent use of such event channels would then possibly lead to corruption of other parts of the shared info structure. An unprivileged guest may cause another domain, in particular Domain 0, to misbehave. This may lead to a Denial of Service (DoS) for the entire system. All Xen versions from 4.4 onwards are vulnerable. Xen versions 4.3 and earlier are not vulnerable. Only x86 32-bit domains servicing other domains are vulnerable. Arm systems, as well as x86 64-bit domains, are not vulnerable.

Risk And Classification

Problem Types: CWE-787

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Debian	Debian Linux	10.0	All	All	All
Operating System	Fedoraproject	Fedora	31	All	All	All
Operating System	Fedoraproject	Fedora	32	All	All	All
Operating System	Fedoraproject	Fedora	33	All	All	All
Operating System	Fedoraproject	Fedora	32	All	All	All
Operating System	Fedoraproject	Fedora	33	All	All	All
Operating System	Opensuse	Leap	15.2	All	All	All
Operating System	Opensuse	Leap	15.2	All	All	All
Operating System	Xen	Xen	All	All	All	All

References

Reference	Source	Link	Tags
[SECURITY] Fedora 32 Update: xen-4.13.1-6.fc32 - package-announce - Fedora Mailing-Lists		lists.fedoraproject.org
Xen: Multiple vulnerabilities (GLSA 202011-06) — Gentoo security	GENTOO	security.gentoo.org
[SECURITY] Fedora 33 Update: xen-4.14.0-5.fc33 - package-announce - Fedora Mailing-Lists		lists.fedoraproject.org
XSA-342 - Xen Security Advisories	MISC	xenbits.xen.org	Vendor Advisory
[SECURITY] Fedora 31 Update: xen-4.12.3-5.fc31 - package-announce - Fedora Mailing-Lists	FEDORA	lists.fedoraproject.org
[SECURITY] Fedora 31 Update: xen-4.12.3-5.fc31 - package-announce - Fedora Mailing-Lists		lists.fedoraproject.org
[SECURITY] Fedora 32 Update: xen-4.13.1-6.fc32 - package-announce - Fedora Mailing-Lists	FEDORA	lists.fedoraproject.org	Third Party Advisory
[security-announce] openSUSE-SU-2020:1608-1: important: Security update	SUSE	lists.opensuse.org	Third Party Advisory
Debian -- Security Information -- DSA-4769-1 xen	DEBIAN	www.debian.org	Third Party Advisory
[SECURITY] Fedora 33 Update: xen-4.14.0-5.fc33 - package-announce - Fedora Mailing-Lists	FEDORA	lists.fedoraproject.org	Third Party Advisory
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

198943 Ubuntu Security Notification for Xen Vulnerabilities (USN-5617-1)
500792 Alpine Linux Security Update for xen
501512 Alpine Linux Security Update for xen
504536 Alpine Linux Security Update for xen