Xen up to 4.14.x SYSENTER null termination

Summaryinfo

A vulnerability was found in Xen up to 4.14.x. It has been rated as problematic. The affected element is the function SYSENTER. Performing a manipulation results in null termination. This vulnerability is known as CVE-2020-25596. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Xen up to 4.14.x (Virtualization Software). This affects the function SYSENTER. The manipulation with an unknown input leads to a null termination vulnerability. CWE is classifying the issue as CWE-170. The product does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator. This is going to have an impact on availability. The summary by CVE is:

An issue was discovered in Xen through 4.14.x. x86 PV guest kernels can experience denial of service via SYSENTER. The SYSENTER instruction leaves various state sanitization activities to software. One of Xen's sanitization paths injects a #GP fault, and incorrectly delivers it twice to the guest. This causes the guest kernel to observe a kernel-privilege #GP fault (typically fatal) rather than a user-privilege #GP fault (usually converted into SIGSEGV/etc.). Malicious or buggy userspace can crash the guest kernel, resulting in a VM Denial of Service. All versions of Xen from 3.2 onwards are vulnerable. Only x86 systems are vulnerable. ARM platforms are not vulnerable. Only x86 systems that support the SYSENTER instruction in 64bit mode are vulnerable. This is believed to be Intel, Centaur, and Shanghai CPUs. AMD and Hygon CPUs are not believed to be vulnerable. Only x86 PV guests can exploit the vulnerability. x86 PVH / HVM guests cannot exploit the vulnerability.

The weakness was published 09/23/2020. This vulnerability is uniquely identified as CVE-2020-25596 since 09/16/2020. Technical details are known, but no exploit is available.

Upgrading eliminates this vulnerability.

Similar entries are available at VDB-161809, VDB-161808, VDB-161807 and VDB-161806. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• Xen
• Citrix Hypervisor up to 8.2 LTSR

Productinfo

Type

• Virtualization Software

Name

• Xen

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6
• 4.7
• 4.8
• 4.9
• 4.10
• 4.11
• 4.12
• 4.13
• 4.14

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion