Xen up to 4.13.x Hypercall memory corruption

Summaryinfo

A vulnerability classified as critical has been found in Xen up to 4.13.x. This affects an unknown function. Performing a manipulation as part of Hypercall results in memory corruption. This vulnerability is reported as CVE-2020-11739. The attack requires a local approach. No exploit exists.

Detailsinfo

A vulnerability classified as critical has been found in Xen up to 4.13.x (Virtualization Software). This affects some unknown processing. The manipulation as part of a Hypercall leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service or possibly gain privileges because of missing memory barriers in read-write unlock paths. The read-write unlock paths don't contain a memory barrier. On Arm, this means a processor is allowed to re-order the memory access with the preceding ones. In other words, the unlock may be seen by another processor before all the memory accesses within the "critical" section. As a consequence, it may be possible to have a writer executing a critical section at the same time as readers or another writer. In other words, many of the assumptions (e.g., a variable cannot be modified after a check) in the critical sections are not safe anymore. The read-write locks are used in hypercalls (such as grant-table ones), so a malicious guest could exploit the race. For instance, there is a small window where Xen can leak memory if XENMAPSPACE_grant_table is used concurrently. A malicious guest may be able to leak memory, or cause a hypervisor crash resulting in a Denial of Service (DoS). Information leak and privilege escalation cannot be excluded.

The weakness was disclosed 04/14/2020 (oss-sec). The advisory is shared at openwall.com. This vulnerability is uniquely identified as CVE-2020-11739 since 04/14/2020. An attack has to be approached locally. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 04/15/2020).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-153121, VDB-153120, VDB-153119 and VDB-153118 are pretty similar. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Virtualization Software

Name

• Xen

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6
• 4.7
• 4.8
• 4.9
• 4.10
• 4.11
• 4.12
• 4.13

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion