CVE-2020-25598

{"id": "CVE-2020-25598", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2020-09-23T22:15:13.367", "references": [{"url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00008.html", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4JRXMKEMQRQYWYEPHVBIWUEAVQ3LU4FN/", "source": "cve@mitre.org"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DA633Y3G5KX7MKRN4PFEGM3IVTJMBEOM/", "source": "cve@mitre.org"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RJZERRBJN6E6STDCHT4JHP4MI6TKBCJE/", "source": "cve@mitre.org"}, {"url": "https://security.gentoo.org/glsa/202011-06", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://xenbits.xen.org/xsa/advisory-334.html", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-670"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Xen 4.14.x. There is a missing unlock in the XENMEM_acquire_resource error path. The RCU (Read, Copy, Update) mechanism is a synchronisation primitive. A buggy error path in the XENMEM_acquire_resource exits without releasing an RCU reference, which is conceptually similar to forgetting to unlock a spinlock. A buggy or malicious HVM stubdomain can cause an RCU reference to be leaked. This causes subsequent administration operations, (e.g., CPU offline) to livelock, resulting in a host Denial of Service. The buggy codepath has been present since Xen 4.12. Xen 4.14 and later are vulnerable to the DoS. The side effects are believed to be benign on Xen 4.12 and 4.13, but patches are provided nevertheless. The vulnerability can generally only be exploited by x86 HVM VMs, as these are generally the only type of VM that have a Qemu stubdomain. x86 PV and PVH domains, as well as ARM VMs, typically don't use a stubdomain. Only VMs using HVM stubdomains can exploit the vulnerability. VMs using PV stubdomains, or with emulators running in dom0, cannot exploit the vulnerability."}, {"lang": "es", "value": "Se detect\u00f3 un problema en Xen versi\u00f3n 4.14.x. Se presenta una carencia de desbloqueo en la ruta de error de XENMEM_acquire_resource. El mecanismo RCU (Read, Copy, Update) es una primitiva de sincronizaci\u00f3n. Una ruta de error incorrecta en XENMEM_acquire_resource sale sin liberar una referencia de RCU, que es conceptualmente similar a olvidar desbloquear un spinlock. Un subdominio HVM con errores o malicioso puede hacer que se filtre una referencia de RCU. Esto hace que las operaciones de administraci\u00f3n posteriores (por ejemplo, CPU fuera de l\u00ednea) se bloquean, lo que resulta en una Denegaci\u00f3n de Servicio del host. La ruta de c\u00f3digo con errores ha estado presente desde Xen versi\u00f3n 4.12. Xen versiones 4.14 y posteriores son vulnerables a una DoS. Se cree que los efectos secundarios son benignos en Xen versiones 4.12 y 4.13, pero los parches son proporcionados. La vulnerabilidad generalmente solo puede ser explotada por m\u00e1quinas virtuales HVM x86, ya que estos son generalmente el \u00fanico tipo de VM que tiene un stubdomain de Qemu. Los dominios PV y PVH x86, as\u00ed como las m\u00e1quinas virtuales ARM, no suelen usar un dominio auxiliar. Solo las m\u00e1quinas virtuales que usan dominios de c\u00f3digo auxiliar HVM pueden explotar la vulnerabilidad. Las m\u00e1quinas virtuales que usan stubdomains de PV o con emuladores que son ejecutadas en dom0 no pueden explotar la vulnerabilidad."}], "lastModified": "2023-11-07T03:20:16.537", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BFB26B47-B1CF-459D-A02F-24D796E3180C", "versionEndIncluding": "4.14.0", "versionStartIncluding": "4.12.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "80F0FA5D-8D3B-4C0E-81E2-87998286AF33"}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "36D96259-24BD-44E2-96D9-78CE1D41F956"}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E460AA51-FCDA-46B9-AE97-E6676AA5E194"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B009C22E-30A4-4288-BCF6-C3E81DEAF45A"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}