Host OS Crash in Xen due to Incorrect Error Handling in Event-Channel Port Allocation
Summary
CVE-2020-15566: An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a host OS crash because of incorrect error handling in event-channel port allocation. Affects xen versions < 4.12.3-r2. Fixed in 4.12.3-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Xen is an open-source hypervisor that allows multiple operating systems to run on a single host machine. It provides virtualization capabilities and manages the allocation of hardware resources to guest operating systems. This vulnerability affects Xen versions 4.10 and later. The default configuration, when guests are created with xl/libxl, is not vulnerable. However, if a guest is configured to allow more than 1023 event channels, it may be able to crash the host OS.
Vulnerability Detail
The vulnerability (CVE-2020-15566) arises from incorrect error handling in event-channel port allocation. When allocating an event-channel port, there are multiple possible failure scenarios: (1) the port is already in use, (2) memory allocation fails, or (3) the port exceeds the supported limit set by the guest or administrator. However, due to missing error checks, only the first scenario is considered an error. As a result, if a guest is configured with more than 1023 event channels and Xen is out of memory, attempting to allocate new event channels will crash the host OS instead of reporting an error.
How To Fix
Minimum fixed version
4.12.3-r2
This is the first release that contains the fix.
sudo apk add --upgrade xenTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the vulnerability in Xen's event-channel port allocation can lead to a host OS crash if a guest is configured to allow more than 1023 event channels and Xen runs out of memory. It is crucial to update Xen to the fixed version and ensure that guests are not configured with excessive event channels. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for xen →
FAQ
Xen is an open-source hypervisor that allows multiple operating systems to run on a single host machine. It provides virtualization capabilities and manages the allocation of hardware resources to guest operating systems.
Xen versions 4.10 and later are affected by this vulnerability.
The default configuration sets a limit on the number of event channels a guest can have, preventing the allocation of more than 1023 event channels.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Xen installation is affected by this vulnerability. Simply upload your package-lock.json file and the Vulert Playground will analyze it for vulnerabilities in real-time.
The CVSS score of this vulnerability is 6.5, indicating a medium severity level.
Related vulnerabilities
Recent vulnerabilities recorded for xen.
