SB2020092341 - Resource management error in xen (Alpine package)
Published: September 23, 2020
Security Bulletin ID
SB2020092341
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Resource management error (CVE-ID: CVE-2020-25603)
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to event channels control structures can be accessed lockless as long as the port is considered to be valid. Such sequence is missing appropriate memory barrier (e.g smp_*mb()) to prevent both the compiler and CPU to re-order access. A malicious guest may be able to cause a hypervisor crash.
Remediation
Install update from vendor's website.