Critical Hypervisor Crash Vulnerability in Xen Package
Summary
ALPINE-CVE-2020-15564: An issue was discovered in Xen through 4.13.x, allowing Arm guest OS users to cause a hypervisor crash because of a missing alignment check in VCPUOP_register_vcpu_info. Affects xen versions < 4.12.3-r2. Fixed in 4.12.3-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Xen is an open-source hypervisor that allows multiple operating systems to run concurrently on a single physical machine. It is widely used in cloud computing and virtualization environments. The Xen package is crucial for managing virtual machines and providing isolation between them. However, it has been identified to have a vulnerability that affects Arm systems, potentially leading to a hypervisor crash.
Vulnerability Detail
An issue was discovered in Xen through version 4.13.x, where Arm guest OS users can cause a hypervisor crash due to a missing alignment check in the VCPUOP_register_vcpu_info hypercall. This hypercall is used by guests to register a shared region with the hypervisor, which is then mapped into Xen's address space for direct access. The lack of alignment checks allows a malicious guest to pass a misaligned address, leading to a Denial of Service (DoS) attack. All versions of Xen are vulnerable, but only Arm systems are affected, while x86 systems remain unaffected.
How To Fix
Minimum fixed version
4.12.3-r2
This is the first release that contains the fix.
sudo apk add --upgrade xenTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider isolating Arm systems from untrusted guest OS users to prevent potential exploitation until the package can be updated.
Conclusion
The identified vulnerability in the Xen package poses a significant risk to Arm systems, allowing malicious guests to crash the hypervisor. It is crucial to update to the patched versions to mitigate this risk. Users are encouraged to utilize tools like Vulert for ongoing vulnerability monitoring.
See every vulnerability recorded for xen →
FAQ
The CVSS score of this vulnerability is 6.5, indicating a medium severity level.
Only Arm systems are affected by this vulnerability; x86 systems are not impacted.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If this vulnerability is not addressed, a malicious guest could exploit it to crash the hypervisor, leading to a Denial of Service (DoS) for all virtual machines running on that hypervisor.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for xen.
