CVE-2020-11741
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
An issue was discovered in xenoprof in Xen through 4.13.x, allowing guest OS users (with active profiling) to obtain sensitive information about other guests, cause a denial of service, or possibly gain privileges. For guests for which "active" profiling was enabled by the administrator, the xenoprof code uses the standard Xen shared ring structure. Unfortunately, this code did not treat the guest as a potential adversary: it trusts the guest not to modify buffer size information or modify head / tail pointers in unexpected ways. This can crash the host (DoS). Privilege escalation cannot be ruled out.
Se detectó un problema en xenoprof en Xen versiones hasta 4.13.x, que permitía a usuarios invitados del Sistema Operativo (con perfiles activos) obtener información confidencial sobre otros invitados, causar una denegación de servicio o posiblemente alcanzar privilegios. Para aquellos invitados a los que el administrador habilitó la creación de perfiles "active", el código xenoprof usa la estructura de anillo compartida de Xen estándar. Desafortunadamente, este código no trató al invitado como un adversario potencial: confía en que el invitado no modificará la información del tamaño del búfer ni modificará los punteros de cabeza y cola de forma inesperada. Esto puede bloquear el host (DoS). La escalada de privilegios no puede ser descartada.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-04-14 CVE Reserved
- 2020-04-14 CVE Published
- 2023-03-08 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-909: Missing Initialization of Resource
CAPEC
References (9)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2020/04/14/1 | 2023-11-07 | |
| http://xenbits.xen.org/xsa/advisory-313.html | 2023-11-07 | |
| https://xenbits.xen.org/xsa/advisory-313.html | 2023-11-07 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Xen Search vendor "Xen" | Xen Search vendor "Xen" for product "Xen" | <= 4.13.0 Search vendor "Xen" for product "Xen" and version " <= 4.13.0" | - |
Affected
| ||||||
| Xen Search vendor "Xen" | Xen Search vendor "Xen" for product "Xen" | 4.13.0 Search vendor "Xen" for product "Xen" and version "4.13.0" | rc1 |
Affected
| ||||||
| Xen Search vendor "Xen" | Xen Search vendor "Xen" for product "Xen" | 4.13.0 Search vendor "Xen" for product "Xen" and version "4.13.0" | rc2 |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 30 Search vendor "Fedoraproject" for product "Fedora" and version "30" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 31 Search vendor "Fedoraproject" for product "Fedora" and version "31" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 32 Search vendor "Fedoraproject" for product "Fedora" and version "32" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0" | - |
Affected
| ||||||
| Opensuse Search vendor "Opensuse" | Leap Search vendor "Opensuse" for product "Leap" | 15.1 Search vendor "Opensuse" for product "Leap" and version "15.1" | - |
Affected
| ||||||