Your submission was sent successfully! Close

You have successfully unsubscribed! Close

CVE-2020-25595

Published: 23 September 2020

An issue was discovered in Xen through 4.14.x. The PCI passthrough code improperly uses register data. Code paths in Xen's MSI handling have been identified that act on unsanitized values read back from device hardware registers. While devices strictly compliant with PCI specifications shouldn't be able to affect these registers, experience shows that it's very common for devices to have out-of-spec "backdoor" operations that can affect the result of these reads. A not fully trusted guest may be able to crash Xen, leading to a Denial of Service (DoS) for the entire system. Privilege escalation and information leaks cannot be excluded. All versions of Xen supporting PCI passthrough are affected. Only x86 systems are vulnerable. Arm systems are not vulnerable. Only guests with passed through PCI devices may be able to leverage the vulnerability. Only systems passing through devices with out-of-spec ("backdoor") functionality can cause issues. Experience shows that such out-of-spec functionality is common; unless you have reason to believe that your device does not have such functionality, it's better to assume that it does.

Notes

AuthorNote
mdeslaur
hypervisor packages are in universe. For
issues in the hypervisor, add appropriate
tags to each section, ex:
Tags_xen: universe-binary
Priority

Medium

CVSS 3 base score: 7.8

Status

Package Release Status
xen
Launchpad, Ubuntu, Debian
bionic Needed

focal
Released (4.11.3+24-g14b62ab3e5-1ubuntu2.3)
groovy Ignored
(reached end-of-life)
hirsute Ignored
(reached end-of-life)
impish Ignored
(reached end-of-life)
jammy Not vulnerable
(4.11.4+37-g3263f257ca-1)
kinetic Not vulnerable
(4.11.4+37-g3263f257ca-1)
precise Does not exist

trusty Does not exist

upstream Needs triage

xenial Needed

Binaries built from this source package are in Universe and so are supported by the community.