Vulnerability in Xen Package (CVE-2020-29479)
Summary
CVE-2020-29479: An issue was discovered in Xen through 4.14.x. Affects xen versions < 4.13.2-r3. Fixed in 4.13.2-r3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Xen package is an open-source hypervisor that provides virtualization capabilities for various operating systems. It allows multiple guest operating systems to run on a single host system. The package includes the Ocaml xenstored implementation, which is responsible for managing the Xenstore tree, a shared storage area for communication between the host and guest systems. This vulnerability affects all systems using oxenstored, the default implementation in the upstream Xen distribution if the Ocaml compiler is available.
Vulnerability Detail
The vulnerability (CVE-2020-29479) in Xen through version 4.14.x arises from a flaw in the Ocaml xenstored implementation. The internal representation of the Xenstore tree has special cases for the root node, which has no parent. However, permissions were not properly checked for certain operations on the root node. This allows unprivileged guests to manipulate permissions, list, and delete the root node. Deleting the entire xenstore tree can lead to a host-wide denial of service. Additionally, this vulnerability enables unprivileged guests to gain write access to the xenstore, potentially leading to further exploitation. Systems using C xenstored are not affected.
How To Fix
Minimum fixed version
4.13.2-r3
This is the first release that contains the fix.
sudo apk add --upgrade xenTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided fix by updating the Xen package to the recommended version.
Conclusion
The vulnerability in the Xen package (CVE-2020-29479) exposes systems using the oxenstored implementation to potential denial of service and unauthorized access to the xenstore. It is crucial to update the Xen package to version 4.13.2-r3 or later to mitigate this vulnerability. Regularly updating the package will help ensure protection against future vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for xen →
FAQ
The vulnerability allows unprivileged guests to manipulate permissions, list, and delete the root node in the Xenstore tree. This can lead to a host-wide denial of service and potential unauthorized access to the xenstore.
No, only systems using the oxenstored implementation in the upstream Xen distribution with the Ocaml compiler available are affected. Systems using C xenstored are not vulnerable.
Yes, unprivileged guests can gain write access to the xenstore, allowing them to potentially exploit further vulnerabilities or perform unauthorized actions.
No, there is no known workaround. It is crucial to update the Xen package to the fixed version as soon as possible.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will provide real-time monitoring and alerts for open-source vulnerabilities, including this one.
Related vulnerabilities
Recent vulnerabilities recorded for xen.
