5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
2.1 Low
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:N/I:N/A:P
xen is vulnerable to denial of service (DoS). The vulnerability exists through the bad continuation handling in GNTTABOP_copy. Grant table operations are expected to return 0 for success, and a negative number for errors. The fix for CVE-2017-12135 introduced a path through grant copy handling where success may be returned to the caller without any action taken. In particular, the status fields of individual operations are left uninitialised, and may result in errant behaviour in the caller of GNTTABOP_copy. A buggy or malicious guest can construct its grant table in such a way that, when a backend domain tries to copy a grant, it hits the incorrect exit path.
lists.opensuse.org/opensuse-security-announce/2020-05/msg00006.html
www.openwall.com/lists/oss-security/2020/04/14/4
xenbits.xen.org/xsa/advisory-318.html
lists.fedoraproject.org/archives/list/[email protected]/message/5M2XRNCHOGGTJQBZQJ7DCV6ZNAKN3LE2/
lists.fedoraproject.org/archives/list/[email protected]/message/NVTP4OYHCTRU3ONFJOFJQVNDFB25KLLG/
lists.fedoraproject.org/archives/list/[email protected]/message/YMAW7D2MP6RE4BFI5BZWOBBWGY3VSOFN/
security.gentoo.org/glsa/202005-08
www.debian.org/security/2020/dsa-4723
xenbits.xen.org/xsa/advisory-318.html
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
2.1 Low
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:N/I:N/A:P