An issue was discovered in Xen through 4.14.x. An x86 PV guest can trigger a host OS crash when handling guest access to MSR_MISC_ENABLE. When a guest accesses certain Model Specific Registers, Xen first reads the value from hardware to use as the basis for auditing the guest access. For the MISC_ENABLE MSR, which is an Intel specific MSR, this MSR read is performed without error handling for a #GP fault, which is the consequence of trying to read this MSR on non-Intel hardware. A buggy or malicious PV guest administrator can crash Xen, resulting in a host Denial of Service. Only x86 systems are vulnerable. ARM systems are not vulnerable. Only Xen versions 4.11 and onwards are vulnerable. 4.10 and earlier are not vulnerable. Only x86 systems that do not implement the MISC_ENABLE MSR (0x1a0) are vulnerable. AMD and Hygon systems do not implement this MSR and are vulnerable. Intel systems do implement this MSR and are not vulnerable. Other manufacturers have not been checked. Only x86 PV guests can exploit the vulnerability. x86 HVM/PVH guests cannot exploit the vulnerability.

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5617-1 advisory.

    It was discovered that memory contents previously stored in microarchitectural special registers after     RDRAND, RDSEED, and SGX EGETKEY read operations on Intel client and Xeon E3 processors may be briefly     exposed to processes on the same or different processor cores. A local attacker could use this to expose     sensitive information. (CVE-2020-0543)

    Julien Grall discovered that Xen incorrectly handled memory barriers on ARM-based systems. An attacker     could possibly use this issue to cause a denial of service, obtain sensitive information or escalate     privileges. (CVE-2020-11739)

    Ilja Van Sprundel discovered that Xen incorrectly handled profiling of guests. An unprivileged attacker     could use this issue to obtain sensitive information from other guests, cause a denial of service or     possibly gain privileges. (CVE-2020-11740, CVE-2020-11741)

    It was discovered that Xen incorrectly handled grant tables. A malicious guest could possibly use this     issue to cause a denial of service. (CVE-2020-11742, CVE-2020-11743)

    Jan Beulich discovered that Xen incorrectly handled certain code paths. An attacker could possibly use     this issue to cause a denial of service. (CVE-2020-15563)

    Julien Grall discovered that Xen incorrectly verified memory addresses provided by the guest on ARM-based     systems. A malicious guest administrator could possibly use this issue to cause a denial of service.
    (CVE-2020-15564)

    Roger Pau Monn discovered that Xen incorrectly handled caching on x86 Intel systems. An attacker could     possibly use this issue to cause a denial of service. (CVE-2020-15565)

    It was discovered that Xen incorrectly handled error in event-channel port allocation. A malicious guest     could possibly use this issue to cause a denial of service. (CVE-2020-15566)

    Jan Beulich discovered that Xen incorrectly handled certain EPT (Extended Page Tables).

    An attacker could possibly use this issue to cause a denial of service, data corruption or privilege     escalation. (CVE-2020-15567)

    Andrew Cooper discovered that Xen incorrectly handled PCI passthrough. An attacker could possibly use this     issue to cause a denial of service. (CVE-2020-25595)

    Andrew Cooper discovered that Xen incorrectly sanitized path injections. An attacker could possibly use     this issue to cause a denial of service. (CVE-2020-25596)

    Jan Beulich discovered that Xen incorrectly handled validation of event channels. An attacker could     possibly use this issue to cause a denial of service. (CVE-2020-25597)

    Julien Grall and Jan Beulich discovered that Xen incorrectly handled resetting event channels. An attacker     could possibly use this issue to cause a denial of service or obtain sensitive information.
    (CVE-2020-25599)

    Julien Grall discovered that Xen incorrectly handled event channels memory allocation on 32-bits domains.
    An attacker could possibly use this issue to cause a denial of service. (CVE-2020-25600)

    Jan Beulich discovered that Xen incorrectly handled resetting or cleaning up event channels. An attacker     could possibly use this issue to cause a denial of service. (CVE-2020-25601)

    Andrew Cooper discovered that Xen incorrectly handled certain Intel specific MSR (Model Specific     Registers). An attacker could possibly use this issue to cause a denial of service. (CVE-2020-25602)

    Julien Grall discovered that Xen incorrectly handled accessing/allocating event channels. An attacker     could possibly use this issue to cause a denial of service, obtain sensitive information of privilege     escalation. (CVE-2020-25603)

    Igor Druzhinin discovered that Xen incorrectly handled locks. An attacker could possibly use this issue to     cause a denial of service. (CVE-2020-25604)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A denial of service (DoS) vulnerability exists in Xen server due to missing error handling in MISC_ENABLE MSR. A malicious PV guest administrator can trigger Xen to crash, resulting in a host DoS.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for xen fixes the following issues :

CVE-2020-25602: Fixed an issue where there was a crash when handling guest access to MSR_MISC_ENABLE was thrown (bsc#1176339,XSA-333)

CVE-2020-25598: Added a missing unlock in XENMEM_acquire_resource error path (bsc#1176341,XSA-334)

CVE-2020-25604: Fixed a race condition when migrating timers between x86 HVM vCPU-s (bsc#1176343,XSA-336)

CVE-2020-25595: Fixed an issue where PCI passthrough code was reading back hardware registers (bsc#1176344,XSA-337)

CVE-2020-25597: Fixed an issue where a valid event channels may not turn invalid (bsc#1176346,XSA-338)

CVE-2020-25596: Fixed a potential denial of service in x86 pv guest kernel via SYSENTER (bsc#1176345,XSA-339)

CVE-2020-25603: Fixed an issue due to missing barriers when accessing/allocating an event channel (bsc#1176347,XSA-340)

CVE-2020-25600: Fixed out of bounds event channels available to 32-bit x86 domains (bsc#1176348,XSA-342)

CVE-2020-25599: Fixed race conditions with evtchn_reset() (bsc#1176349,XSA-343)

CVE-2020-25601: Fixed an issue due to lack of preemption in evtchn_reset() / evtchn_destroy() (bsc#1176350,XSA-344)

CVE-2020-14364: Fixed an out-of-bounds read/write access while processing usb packets (bsc#1175534).

Various bug fixes (bsc#1027519)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes the following issues :

CVE-2020-25602: Fixed an issue where there was a crash when handling guest access to MSR_MISC_ENABLE was thrown (bsc#1176339,XSA-333)

CVE-2020-25598: Added a missing unlock in XENMEM_acquire_resource error path (bsc#1176341,XSA-334)

CVE-2020-25604: Fixed a race condition when migrating timers between x86 HVM vCPU-s (bsc#1176343,XSA-336)

CVE-2020-25595: Fixed an issue where PCI passthrough code was reading back hardware registers (bsc#1176344,XSA-337)

CVE-2020-25597: Fixed an issue where a valid event channels may not turn invalid (bsc#1176346,XSA-338)

CVE-2020-25596: Fixed a potential denial of service in x86 pv guest kernel via SYSENTER (bsc#1176345,XSA-339)

CVE-2020-25603: Fixed an issue due to missing barriers when accessing/allocating an event channel (bsc#1176347,XSA-340)

CVE-2020-25600: Fixed out of bounds event channels available to 32-bit x86 domains (bsc#1176348,XSA-342)

CVE-2020-25599: Fixed race conditions with evtchn_reset() (bsc#1176349,XSA-343)

CVE-2020-25601: Fixed an issue due to lack of preemption in evtchn_reset() / evtchn_destroy() (bsc#1176350,XSA-344)

Various other fixes (bsc#1027519)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes the following issues :

CVE-2020-25602: Fixed an issue where there was a crash when handling guest access to MSR_MISC_ENABLE was thrown (bsc#1176339,XSA-333)

CVE-2020-25598: Added a missing unlock in XENMEM_acquire_resource error path (bsc#1176341,XSA-334)

CVE-2020-25604: Fixed a race condition when migrating timers between x86 HVM vCPU-s (bsc#1176343,XSA-336)

CVE-2020-25595: Fixed an issue where PCI passthrough code was reading back hardware registers (bsc#1176344,XSA-337)

CVE-2020-25597: Fixed an issue where a valid event channels may not turn invalid (bsc#1176346,XSA-338)

CVE-2020-25596: Fixed a potential denial of service in x86 pv guest kernel via SYSENTER (bsc#1176345,XSA-339)

CVE-2020-25603: Fixed an issue due to missing barriers when accessing/allocating an event channel (bsc#1176347,XSA-340)

CVE-2020-25600: Fixed out of bounds event channels available to 32-bit x86 domains (bsc#1176348,XSA-342)

CVE-2020-25599: Fixed race conditions with evtchn_reset() (bsc#1176349,XSA-343)

CVE-2020-25601: Fixed an issue due to lack of preemption in evtchn_reset() / evtchn_destroy() (bsc#1176350,XSA-344)

Various bug fixes (bsc#1027519)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202011-06 (Xen: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the       CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

x86 pv: Crash when handling guest access to MSR_MISC_ENABLE [XSA-333, CVE-2020-25602] (#1881619) Missing unlock in XENMEM_acquire_resource error path [XSA-334, CVE-2020-25598] (#1881616) race when migrating timers between x86 HVM vCPU-s [XSA-336, CVE-2020-25604] (#1881618) PCI passthrough code reading back hardware registers [XSA-337, CVE-2020-25595] (#1881587) once valid event channels may not turn invalid [XSA-338, CVE-2020-25597] (#1881588) x86 pv guest kernel DoS via SYSENTER [XSA-339, CVE-2020-25596] (#1881617) Missing memory barriers when accessing/allocating an event channel [XSA-340, CVE-2020-25603] (#1881583) out of bounds event channels available to 32-bit x86 domains [XSA-342, CVE-2020-25600] (#1881582) races with evtchn_reset() [XSA-343, CVE-2020-25599] (#1881581) lack of preemption in evtchn_reset() / evtchn_destroy() [XSA-344, CVE-2020-25601] (#1881586)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xen fixes the following issues :

  - CVE-2020-25602: Fixed an issue where there was a crash     when handling guest access to MSR_MISC_ENABLE was thrown     (bsc#1176339,XSA-333)

  - CVE-2020-25598: Added a missing unlock in     XENMEM_acquire_resource error path (bsc#1176341,XSA-334)

  - CVE-2020-25604: Fixed a race condition when migrating     timers between x86 HVM vCPU-s (bsc#1176343,XSA-336)

  - CVE-2020-25595: Fixed an issue where PCI passthrough     code was reading back hardware registers     (bsc#1176344,XSA-337)

  - CVE-2020-25597: Fixed an issue where a valid event     channels may not turn invalid (bsc#1176346,XSA-338)

  - CVE-2020-25596: Fixed a potential denial of service in     x86 pv guest kernel via SYSENTER (bsc#1176345,XSA-339)

  - CVE-2020-25603: Fixed an issue due to missing barriers     when accessing/allocating an event channel     (bsc#1176347,XSA-340)

  - CVE-2020-25600: Fixed out of bounds event channels     available to 32-bit x86 domains (bsc#1176348,XSA-342)

  - CVE-2020-25599: Fixed race conditions with     evtchn_reset() (bsc#1176349,XSA-343)

  - CVE-2020-25601: Fixed an issue due to lack of preemption     in evtchn_reset() / evtchn_destroy()     (bsc#1176350,XSA-344)

  - Various other fixes (bsc#1027519)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in denial of service, guest-to-host privilege escalation or information leaks.

ID	Name	Product	Family	Severity
165248	Ubuntu 20.04 LTS : Xen vulnerabilities (USN-5617-1)	Nessus	Ubuntu Local Security Checks	high
144862	Xen missing error handling in MSR_MISC_ENABLE DoS (XSA-333)	Nessus	Misc.	medium
143853	SUSE SLES12 Security Update : xen (SUSE-SU-2020:2788-1)	Nessus	SuSE Local Security Checks	high
143707	SUSE SLED15 / SLES15 Security Update : xen (SUSE-SU-2020:2791-1)	Nessus	SuSE Local Security Checks	high
143685	SUSE SLES12 Security Update : xen (SUSE-SU-2020:2786-1)	Nessus	SuSE Local Security Checks	high
143637	SUSE SLED15 / SLES15 Security Update : xen (SUSE-SU-2020:2790-1)	Nessus	SuSE Local Security Checks	high
142854	GLSA-202011-06 : Xen: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
141278	Fedora 31 : xen (2020-d46fe34349)	Nessus	Fedora Local Security Checks	high
141270	Fedora 33 : xen (2020-306b84fd07)	Nessus	Fedora Local Security Checks	high
141168	openSUSE Security Update : xen (openSUSE-2020-1608)	Nessus	SuSE Local Security Checks	high
141138	Debian DSA-4769-1 : xen - security update	Nessus	Debian Local Security Checks	high
141102	Fedora 32 : xen (2020-f668e579be)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2020-25602

medium

Tenable Plugins

high

medium

high

high

high

high

high

high

high

high

high

high