// For flags

CVE-2020-25602

 

Severity Score

6.0
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

An issue was discovered in Xen through 4.14.x. An x86 PV guest can trigger a host OS crash when handling guest access to MSR_MISC_ENABLE. When a guest accesses certain Model Specific Registers, Xen first reads the value from hardware to use as the basis for auditing the guest access. For the MISC_ENABLE MSR, which is an Intel specific MSR, this MSR read is performed without error handling for a #GP fault, which is the consequence of trying to read this MSR on non-Intel hardware. A buggy or malicious PV guest administrator can crash Xen, resulting in a host Denial of Service. Only x86 systems are vulnerable. ARM systems are not vulnerable. Only Xen versions 4.11 and onwards are vulnerable. 4.10 and earlier are not vulnerable. Only x86 systems that do not implement the MISC_ENABLE MSR (0x1a0) are vulnerable. AMD and Hygon systems do not implement this MSR and are vulnerable. Intel systems do implement this MSR and are not vulnerable. Other manufacturers have not been checked. Only x86 PV guests can exploit the vulnerability. x86 HVM/PVH guests cannot exploit the vulnerability.

Se detectó un problema en Xen versiones hasta 4.14.x. Un invitado PV x86 puede desencadenar un bloqueo del Sistema Operativo del host cuando maneja el acceso de invitado para MSR_MISC_ENABLE. Cuando un invitado accede a ciertos registros específicos del modelo, Xen primero lee el valor del hardware para usarlo como base para auditar el acceso de invitado. Para el MSR MISC_ENABLE, que es un MSR específico de Intel, esta lectura de MSR se realiza sin manejo de errores para un fallo #GP, que es la consecuencia de intentar leer este MSR en hardware que no es de Intel. Un administrador invitado de PV con errores o malicioso puede bloquear Xen y causar una Denegación de Servicio del host. Solo los sistemas x86 son vulnerables. Los sistemas ARM no son vulnerables. Solo las versiones de Xen 4.11 y posteriores son vulnerables. Las versiones 4.10 y anteriores no son vulnerables. Solo los sistemas x86 que no implementan MISC_ENABLE MSR (0x1a0) son vulnerables. Los sistemas AMD e Hygon no implementan este MSR y son vulnerables. Los sistemas Intel implementan este MSR y no son vulnerables. No se han comprobado otros fabricantes. Solo los invitados PV x86 pueden explotar la vulnerabilidad. Los invitados HVM/PVH x86 no pueden explotar la vulnerabilidad.

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Local
Attack Complexity
Low
Authentication
Single
Confidentiality
None
Integrity
None
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-09-16 CVE Reserved
  • 2020-09-23 CVE Published
  • 2023-03-08 EPSS Updated
  • 2024-08-04 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-755: Improper Handling of Exceptional Conditions
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Xen
Search vendor "Xen"
Xen
Search vendor "Xen" for product "Xen"
>= 4.11.0 <= 4.14.0
Search vendor "Xen" for product "Xen" and version " >= 4.11.0 <= 4.14.0"
-
Affected
Fedoraproject
Search vendor "Fedoraproject"
Fedora
Search vendor "Fedoraproject" for product "Fedora"
31
Search vendor "Fedoraproject" for product "Fedora" and version "31"
-
Affected
Fedoraproject
Search vendor "Fedoraproject"
Fedora
Search vendor "Fedoraproject" for product "Fedora"
32
Search vendor "Fedoraproject" for product "Fedora" and version "32"
-
Affected
Fedoraproject
Search vendor "Fedoraproject"
Fedora
Search vendor "Fedoraproject" for product "Fedora"
33
Search vendor "Fedoraproject" for product "Fedora" and version "33"
-
Affected
Debian
Search vendor "Debian"
Debian Linux
Search vendor "Debian" for product "Debian Linux"
10.0
Search vendor "Debian" for product "Debian Linux" and version "10.0"
-
Affected
Opensuse
Search vendor "Opensuse"
Leap
Search vendor "Opensuse" for product "Leap"
15.2
Search vendor "Opensuse" for product "Leap" and version "15.2"
-
Affected