CVE-2020-15565

Severity Score

8.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

An issue was discovered in Xen through 4.13.x, allowing x86 Intel HVM guest OS users to cause a host OS denial of service or possibly gain privileges because of insufficient cache write-back under VT-d. When page tables are shared between IOMMU and CPU, changes to them require flushing of both TLBs. Furthermore, IOMMUs may be non-coherent, and hence prior to flushing IOMMU TLBs, a CPU cache also needs writing back to memory after changes were made. Such writing back of cached data was missing in particular when splitting large page mappings into smaller granularity ones. A malicious guest may be able to retain read/write DMA access to frames returned to Xen's free pool, and later reused for another purpose. Host crashes (leading to a Denial of Service) and privilege escalation cannot be ruled out. Xen versions from at least 3.2 onwards are affected. Only x86 Intel systems are affected. x86 AMD as well as Arm systems are not affected. Only x86 HVM guests using hardware assisted paging (HAP), having a passed through PCI device assigned, and having page table sharing enabled can leverage the vulnerability. Note that page table sharing will be enabled (by default) only if Xen considers IOMMU and CPU large page size support compatible.

Se detectó un problema en Xen versiones hasta 4.13.x, que permitía a usuarios de Sistemas Operativos invitados Intel HVM x86 causar una denegación de servicio del Sistema Operativo host o posiblemente alcanzar privilegios debido a la insuficiente reescritura de caché en VT-d. Cuando las tablas de páginas se comparten entre IOMMU y la CPU, los cambios en ellas requieren el vaciado de ambos TLB. Además, los IOMMU pueden no ser coherentes y, por lo tanto, antes de vaciar los TLB de IOMMU, una memoria caché de la CPU también necesita volver a escribirse en la memoria después de realizar los cambios. Tal escritura de datos en caché faltaba en particular al dividir las asignaciones de páginas grandes en las de granularidad más pequeñas. Un huésped malicioso puede retener el acceso de lectura/escritura de DMA a los marcos devueltos al grupo gratuito de Xen y luego reutilizarlos para otro propósito. Los bloqueos del host (conllevan a una Denegación de Servicio) y una escalada de privilegios no puede ser descartada. Las versiones Xen de al menos 3.2 en adelante están afectadas. Solo están afectados los sistemas Intel x86. Los sistemas x86 AMD y Arm no están afectados. Solo los invitados x86 HVM que usan paginación asistida por hardware (HAP), que tienen asignado un dispositivo PCI pasado y que tienen habilitado el uso compartido de tablas de páginas pueden aprovechar la vulnerabilidad. Tenga en cuenta que el uso compartido de la tabla de páginas será habilitada (por defecto) solo si Xen considera que IOMMU y la CPU de gran tamaño de página son compatibles

*Credits: N/A

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2020-07-06 CVE Reserved
2020-07-07 CVE Published
2023-03-08 EPSS Updated
2024-08-04 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-400: Uncontrolled Resource Consumption

CAPEC

References (8)

URL	Tag	Source
http://www.openwall.com/lists/oss-security/2020/07/07/4	Mailing List

URL	Date	SRC

URL	Date	SRC
http://xenbits.xen.org/xsa/advisory-321.html	2023-11-07

URL	Date	SRC
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00024.html	2023-11-07
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00031.html	2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MXESCOVI7AVRNC7HEAMFM7PMEO6D3AUH	2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VB3QJJZV23Z2IDYEMIHELWYSQBUEW6JP	2023-11-07
https://security.gentoo.org/glsa/202007-02	2023-11-07
https://www.debian.org/security/2020/dsa-4723	2023-11-07

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Xen Search vendor "Xen"		Xen Search vendor "Xen" for product "Xen"				>= 3.2.0 <= 4.13.1 Search vendor "Xen" for product "Xen" and version " >= 3.2.0 <= 4.13.1"		x86		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				31 Search vendor "Fedoraproject" for product "Fedora" and version "31"		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				32 Search vendor "Fedoraproject" for product "Fedora" and version "32"		-		Affected
Opensuse Search vendor "Opensuse"		Leap Search vendor "Opensuse" for product "Leap"				15.1 Search vendor "Opensuse" for product "Leap" and version "15.1"		-		Affected
Opensuse Search vendor "Opensuse"		Leap Search vendor "Opensuse" for product "Leap"				15.2 Search vendor "Opensuse" for product "Leap" and version "15.2"		-		Affected