Veracode Vulnerability DatabaseVERACODE:29093CVE-2020-27674
5.3 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
4.6 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:P/A:P
Xen is vulnerable to privilege escalation. An attacker can gain guest OS privileges by modifying kernel memory contents, because invalidation of TLB entries is mishandled during use of an INVLPG-like attack technique.
References
www.openwall.com/lists/oss-security/2021/01/19/5
lists.fedoraproject.org/archives/list/[email protected]/message/PZAM3LYJ5TZLSSNL3KXFILM46QKVTOUA/
lists.fedoraproject.org/archives/list/[email protected]/message/U3U4LNKKXU4UP4Z5XP6TMIWSML3QODPE/
lists.fedoraproject.org/archives/list/[email protected]/message/XIK57QJOVOPWH6RFRNMGOBCROBCKMDG2/
secdb.alpinelinux.org/v3.10/main.yaml
secdb.alpinelinux.org/v3.11/main.yaml
secdb.alpinelinux.org/v3.12/main.yaml
security.gentoo.org/glsa/202011-06
www.debian.org/security/2020/dsa-4804
xenbits.xen.org/xsa/advisory-286.html
Related
5.3 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
4.6 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:P/A:P