CVE-2020-15566
First published: Tue Jul 07 2020(Updated: )
An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a host OS crash because of incorrect error handling in event-channel port allocation. The allocation of an event-channel port may fail for multiple reasons: (1) port is already in use, (2) the memory allocation failed, or (3) the port we try to allocate is higher than what is supported by the ABI (e.g., 2L or FIFO) used by the guest or the limit set by an administrator (max_event_channels in xl cfg). Due to the missing error checks, only (1) will be considered an error. All the other cases will provide a valid port and will result in a crash when trying to access the event channel. When the administrator configured a guest to allow more than 1023 event channels, that guest may be able to crash the host. When Xen is out-of-memory, allocation of new event channels will result in crashing the host rather than reporting an error. Xen versions 4.10 and later are affected. All architectures are affected. The default configuration, when guests are created with xl/libxl, is not vulnerable, because of the default event-channel limit.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Xen Xen | >=4.10.0<=4.13.1 | |
| Debian Debian Linux | =10.0 | |
| debian/xen | 4.14.6-1 4.14.5+94-ge49571868d-1 4.17.3+10-g091466ba55-1~deb12u1 4.17.3+36-g54dacb5c02-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00024.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00031.html
- http://www.openwall.com/lists/oss-security/2020/07/07/2
- http://xenbits.xen.org/xsa/advisory-317.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MXESCOVI7AVRNC7HEAMFM7PMEO6D3AUH/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VB3QJJZV23Z2IDYEMIHELWYSQBUEW6JP/
- https://security.gentoo.org/glsa/202007-02
- https://www.debian.org/security/2020/dsa-4723
- https://launchpad.net/bugs/cve/CVE-2020-15566
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MXESCOVI7AVRNC7HEAMFM7PMEO6D3AUH/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VB3QJJZV23Z2IDYEMIHELWYSQBUEW6JP/
- https://xenbits.xen.org/xsa/advisory-317.html
- https://security-tracker.debian.org/tracker/CVE-2020-15566
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15566
- https://nvd.nist.gov/vuln/detail/CVE-2020-15566
- https://ubuntu.com/security/CVE-2020-15566
Frequently Asked Questions
What is CVE-2020-15566?
CVE-2020-15566 is a vulnerability in Xen that allows guest OS users to cause a host OS crash due to incorrect error handling in event-channel port allocation.
How does CVE-2020-15566 affect the software?
CVE-2020-15566 affects Xen versions up to 4.13.x.
What is the severity of CVE-2020-15566?
The severity of CVE-2020-15566 is not specified.
How can I fix CVE-2020-15566?
To fix CVE-2020-15566, update to Xen version 4.11.3+24- or apply the appropriate patches provided by the vendor.
Where can I find more information about CVE-2020-15566?
You can find more information about CVE-2020-15566 on the Xen security advisory at http://xenbits.xen.org/xsa/advisory-317.html and the Debian security advisory at https://www.debian.org/security/2020/dsa-4723.
- collector/nvd-index
- agent/type
- collector/launchpad-cve
- source/Launchpad
- agent/author
- agent/weakness
- agent/severity
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- collector/security-tracker-debian
- source/Debian
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/usn-cve
- source/Ubuntu
- agent/references
- agent/softwarecombine
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- agent/trending
- vendor/xen
- canonical/xen xen
- version/xen xen/4.10.0
- version/xen xen/4.13.1
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/10.0
- package-manager/debian