SB2021012420 - Race condition in xen (Alpine package)
Published: January 24, 2021
Security Bulletin ID
SB2021012420
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Race condition (CVE-ID: CVE-2020-27672)
The vulnerability allows a local authenticated user to execute arbitrary code.
An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a host OS denial of service, achieve data corruption, or possibly gain privileges by exploiting a race condition that leads to a use-after-free involving 2MiB and 1GiB superpages.
Remediation
Install update from vendor's website.
References
- https://git.alpinelinux.org/aports/commit/?id=b7415ec9fb42dde32333fbc1e4575f6bcf11cb32
- https://git.alpinelinux.org/aports/commit/?id=7c351cb852f0cee887b3fcb3a76be20f51350a1a
- https://git.alpinelinux.org/aports/commit/?id=b47f6b6f2e6b179714227cc362a24b0bdb78a028
- https://git.alpinelinux.org/aports/commit/?id=7335a7d4162b6694682183dfea682f282843d5f3
- https://git.alpinelinux.org/aports/commit/?id=91c8694f2fdbc9ff757dc2f658107b9a87428d10