Xen up to 4.13.x xenoprof authorization

Summaryinfo

A vulnerability, which was classified as critical, has been found in Xen up to 4.13.x. Affected is an unknown function of the component xenoprof. The manipulation leads to authorization. This vulnerability is traded as CVE-2020-11741. An attack has to be approached locally. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Xen up to 4.13.x (Virtualization Software). This issue affects an unknown functionality of the component xenoprof. The manipulation with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

An issue was discovered in xenoprof in Xen through 4.13.x, allowing guest OS users (with active profiling) to obtain sensitive information about other guests, cause a denial of service, or possibly gain privileges. For guests for which "active" profiling was enabled by the administrator, the xenoprof code uses the standard Xen shared ring structure. Unfortunately, this code did not treat the guest as a potential adversary: it trusts the guest not to modify buffer size information or modify head / tail pointers in unexpected ways. This can crash the host (DoS). Privilege escalation cannot be ruled out.

The weakness was shared 04/14/2020 (oss-sec). It is possible to read the advisory at openwall.com. The identification of this vulnerability is CVE-2020-11741 since 04/14/2020. Attacking locally is a requirement. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 04/15/2020).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entry VDB-153118 is related to this item. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Virtualization Software

Name

• Xen

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6
• 4.7
• 4.8
• 4.9
• 4.10
• 4.11
• 4.12
• 4.13

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion