high
7.8
CWE
362
Advisory Published
Updated

CVE-2020-15567: Race Condition

First published: Tue Jul 07 2020(Updated: )

An issue was discovered in Xen through 4.13.x, allowing Intel guest OS users to gain privileges or cause a denial of service because of non-atomic modification of a live EPT PTE. When mapping guest EPT (nested paging) tables, Xen would in some circumstances use a series of non-atomic bitfield writes. Depending on the compiler version and optimisation flags, Xen might expose a dangerous partially written PTE to the hardware, which an attacker might be able to race to exploit. A guest administrator or perhaps even an unprivileged guest user might be able to cause denial of service, data corruption, or privilege escalation. Only systems using Intel CPUs are vulnerable. Systems using AMD CPUs, and Arm systems, are not vulnerable. Only systems using nested paging (hap, aka nested paging, aka in this case Intel EPT) are vulnerable. Only HVM and PVH guests can exploit the vulnerability. The presence and scope of the vulnerability depends on the precise optimisations performed by the compiler used to build Xen. If the compiler generates (a) a single 64-bit write, or (b) a series of read-modify-write operations in the same order as the source code, the hypervisor is not vulnerable. For example, in one test build using GCC 8.3 with normal settings, the compiler generated multiple (unlocked) read-modify-write operations in source-code order, which did not constitute a vulnerability. We have not been able to survey compilers; consequently we cannot say which compiler(s) might produce vulnerable code (with which code-generation options). The source code clearly violates the C rules, and thus should be considered vulnerable.

Credit: cve@mitre.org cve@mitre.org

Affected SoftwareAffected VersionHow to fix
Xen Xen<=4.13.1
Debian Debian Linux=10.0
openSUSE Leap=15.1
openSUSE Leap=15.2
Fedoraproject Fedora=31
Fedoraproject Fedora=32
debian/xen
4.14.6-1
4.14.5+94-ge49571868d-1
4.17.3+10-g091466ba55-1~deb12u1
4.17.3+36-g54dacb5c02-1

Remedy

http://xenbits.xen.org/xsa/advisory-328.html

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the vulnerability ID of this issue?

    The vulnerability ID of this issue is CVE-2020-15567.

  • What is the severity of CVE-2020-15567?

    The severity of CVE-2020-15567 is not specified in the provided information.

  • How can Intel guest OS users gain privileges or cause a denial of service due to this vulnerability?

    Intel guest OS users can gain privileges or cause a denial of service due to this vulnerability because of non-atomic modification of a live EPT PTE in Xen.

  • Which software versions are affected by CVE-2020-15567?

    The software versions affected by CVE-2020-15567 include Xen 4.11.3+24- and other specified versions.

  • Where can I find more information about CVE-2020-15567?

    You can find more information about CVE-2020-15567 in the provided references.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203