var-202004-0243
Vulnerability from variot

An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service or possibly gain privileges because of missing memory barriers in read-write unlock paths. The read-write unlock paths don't contain a memory barrier. On Arm, this means a processor is allowed to re-order the memory access with the preceding ones. In other words, the unlock may be seen by another processor before all the memory accesses within the "critical" section. As a consequence, it may be possible to have a writer executing a critical section at the same time as readers or another writer. In other words, many of the assumptions (e.g., a variable cannot be modified after a check) in the critical sections are not safe anymore. The read-write locks are used in hypercalls (such as grant-table ones), so a malicious guest could exploit the race. For instance, there is a small window where Xen can leak memory if XENMAPSPACE_grant_table is used concurrently. A malicious guest may be able to leak memory, or cause a hypervisor crash resulting in a Denial of Service (DoS). Information leak and privilege escalation cannot be excluded. Xen Exists in a buffer error vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. Xen is an open source virtual machine monitor product from the University of Cambridge. The product enables different and incompatible operating systems to run on the same computer and supports migration during runtime to ensure normal operation and avoid downtime.

There is a security vulnerability in Xen 4.13.x and previous versions. An attacker could use this vulnerability to cause a denial of service, possibly obtaining sensitive information or elevating permissions. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202005-08

                                       https://security.gentoo.org/

Severity: Normal Title: Xen: Multiple vulnerabilities Date: May 14, 2020 Bugs: #717446 ID: 202005-08

Synopsis

Multiple vulnerabilities have been found in Xen, the worst of which could allow privilege escalation.

Background

Xen is a bare-metal hypervisor.

Affected packages

-------------------------------------------------------------------
 Package              /     Vulnerable     /            Unaffected
-------------------------------------------------------------------

1 app-emulation/xen < 4.12.2-r2 >= 4.12.2-r2 2 app-emulation/xen-tools < 4.12.2-r2 >= 4.12.2-r2 ------------------------------------------------------------------- 2 affected packages

Description

Multiple vulnerabilities have been discovered in Xen. Please review the CVE identifiers referenced below for details.

Impact

Please review the referenced CVE identifiers for details.

Workaround

There is no known workaround at this time.

Resolution

All Xen users should upgrade to the latest version:

# emerge --sync # emerge --ask --oneshot --verbose ">=app-emulation/xen-4.12.2-r2"

References

[ 1 ] CVE-2020-11739 https://nvd.nist.gov/vuln/detail/CVE-2020-11739 [ 2 ] CVE-2020-11740 https://nvd.nist.gov/vuln/detail/CVE-2020-11740 [ 3 ] CVE-2020-11741 https://nvd.nist.gov/vuln/detail/CVE-2020-11741 [ 4 ] CVE-2020-11742 https://nvd.nist.gov/vuln/detail/CVE-2020-11742 [ 5 ] CVE-2020-11743 https://nvd.nist.gov/vuln/detail/CVE-2020-11743

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

https://security.gentoo.org/glsa/202005-08

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

License

Copyright 2020 Gentoo Foundation, Inc; referenced text belongs to its owner(s).

The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5 .

For the stable distribution (buster), these problems have been fixed in version 4.11.4+24-gddaaccbbab-1~deb10u1.

We recommend that you upgrade your xen packages.

For the detailed security status of xen please refer to its security tracker page at: https://security-tracker.debian.org/tracker/xen

Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAl8Lc/AACgkQEMKTtsN8 TjaMdxAAqGcAm1NI7JRg7LQprevLCPkxPItZapx3n/q/W6HwiGQxC6KP9Ntp3ArR QiIeIPzTWVMHcaahlgkLePaFPU3MCe5TkL0GKG1JIAD8JieKBSrAWJ6tqTiZx+G+ anbksp/I9Mq9nciMlnPXeOVQgksoCB0tFYC2Ld+H7btZdD5G4KpJsz25c0S5poxW sIXLgNXIzmZcI8mVzUlt+w0FG3tnolr/kJppHBkgC46riVcy8LHRaRQiVTjwqjSn Eop4oXxLDZ/qH8k+0JAZLtBPpc9PfQcLxCJnhH8z76QdPPkcJuNFx5zRXqr1dZfG AkRuG6LZa2tRGYzKZmo7BMj5dUei4xhDHLAoWGhSHkTmYtdc1Kyy4+duGPEChSCm fCSC1FhFJFK30iq918cunWtjhRrEqrJr10HuC+YlSXfqrv1Z12fPw3UPRJmdG2Dv UPS5vT8/NwF0osNrvNE+rkhYXTEKECE756pP3jTV4+BBBgf9DLtbV0EvYq1YWlJw iT+KnzX9iW/jJg3bC32+UJlVv7IAkb8F9hcK3wKpvgSUVJIDWN352rfW7p8/xZoj 7eIlmZwDPKWsyMlbt2OsyYQFQlBvNsk0+7ycu9hG6fBaF5ATSxTO+A43Q7OxorP9 g8OhDVMgrx5GM4rXSZ60J6uxkd2eUns4Ud8pDGG8XTpnRBxD8Kk= =tfm7 -----END PGP SIGNATURE----- . ========================================================================== Ubuntu Security Notice USN-5617-1 September 19, 2022

xen vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 20.04 LTS

Summary:

Several security issues were fixed in Xen.

Software Description: - xen: Public headers and libs for Xen

Details:

It was discovered that memory contents previously stored in microarchitectural special registers after RDRAND, RDSEED, and SGX EGETKEY read operations on Intel client and Xeon E3 processors may be briefly exposed to processes on the same or different processor cores. (CVE-2020-0543)

Julien Grall discovered that Xen incorrectly handled memory barriers on ARM-based systems. (CVE-2020-11739)

Ilja Van Sprundel discovered that Xen incorrectly handled profiling of guests. (CVE-2020-11740, CVE-2020-11741)

It was discovered that Xen incorrectly handled grant tables. (CVE-2020-11742, CVE-2020-11743)

Jan Beulich discovered that Xen incorrectly handled certain code paths. (CVE-2020-15563)

Julien Grall discovered that Xen incorrectly verified memory addresses provided by the guest on ARM-based systems. (CVE-2020-15564)

Roger Pau Monn\xe9 discovered that Xen incorrectly handled caching on x86 Intel systems. (CVE-2020-15565)

It was discovered that Xen incorrectly handled error in event-channel port allocation. (CVE-2020-15566)

Jan Beulich discovered that Xen incorrectly handled certain EPT (Extended Page Tables). (CVE-2020-15567)

Andrew Cooper discovered that Xen incorrectly handled PCI passthrough. (CVE-2020-25595)

Andrew Cooper discovered that Xen incorrectly sanitized path injections. (CVE-2020-25596)

Jan Beulich discovered that Xen incorrectly handled validation of event channels. (CVE-2020-25597)

Julien Grall and Jan Beulich discovered that Xen incorrectly handled resetting event channels. (CVE-2020-25599)

Julien Grall discovered that Xen incorrectly handled event channels memory allocation on 32-bits domains. (CVE-2020-25600)

Jan Beulich discovered that Xen incorrectly handled resetting or cleaning up event channels. (CVE-2020-25601)

Andrew Cooper discovered that Xen incorrectly handled certain Intel specific MSR (Model Specific Registers). (CVE-2020-25602)

Julien Grall discovered that Xen incorrectly handled accessing/allocating event channels. (CVE-2020-25603)

Igor Druzhinin discovered that Xen incorrectly handled locks. (CVE-2020-25604)

Update instructions:

The problem can be corrected by updating your system to the following package versions:

Ubuntu 20.04 LTS: libxendevicemodel1 4.11.3+24-g14b62ab3e5-1ubuntu2.3 libxenevtchn1 4.11.3+24-g14b62ab3e5-1ubuntu2.3 libxengnttab1 4.11.3+24-g14b62ab3e5-1ubuntu2.3 libxenmisc4.11 4.11.3+24-g14b62ab3e5-1ubuntu2.3 xen-hypervisor-4.11-amd64 4.11.3+24-g14b62ab3e5-1ubuntu2.3 xen-hypervisor-4.11-arm64 4.11.3+24-g14b62ab3e5-1ubuntu2.3 xen-hypervisor-4.11-armhf 4.11.3+24-g14b62ab3e5-1ubuntu2.3 xen-utils-4.11 4.11.3+24-g14b62ab3e5-1ubuntu2.3 xen-utils-common 4.11.3+24-g14b62ab3e5-1ubuntu2.3 xenstore-utils 4.11.3+24-g14b62ab3e5-1ubuntu2.3

After a standard system update you need to reboot your computer to make all the necessary changes.

References: https://ubuntu.com/security/notices/USN-5617-1 CVE-2020-0543, CVE-2020-11739, CVE-2020-11740, CVE-2020-11741, CVE-2020-11742, CVE-2020-11743, CVE-2020-15563, CVE-2020-15564, CVE-2020-15565, CVE-2020-15566, CVE-2020-15567, CVE-2020-25595, CVE-2020-25596, CVE-2020-25597, CVE-2020-25599, CVE-2020-25600, CVE-2020-25601, CVE-2020-25602, CVE-2020-25603, CVE-2020-25604

Package Information: https://launchpad.net/ubuntu/+source/xen/4.11.3+24-g14b62ab3e5-1ubuntu2.3

Show details on source website

To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202004-0243",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "fedora",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "fedoraproject",
        "version": "32"
      },
      {
        "model": "xen",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "xen",
        "version": "4.13.0"
      },
      {
        "model": "fedora",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "fedoraproject",
        "version": "31"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "debian",
        "version": "10.0"
      },
      {
        "model": "leap",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "opensuse",
        "version": "15.1"
      },
      {
        "model": "xen",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "xen",
        "version": "4.13.0"
      },
      {
        "model": "fedora",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "fedoraproject",
        "version": "30"
      },
      {
        "model": "fedora",
        "scope": null,
        "trust": 0.8,
        "vendor": "fedora",
        "version": null
      },
      {
        "model": "xen",
        "scope": null,
        "trust": 0.8,
        "vendor": "xen",
        "version": null
      },
      {
        "model": "xen",
        "scope": "lte",
        "trust": 0.6,
        "vendor": "xen",
        "version": "\u003c=4.13.x"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-25869"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-004778"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-11739"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "4.13.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:xen:xen:4.13.0:rc1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:xen:xen:4.13.0:rc2:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2020-11739"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Gentoo",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "157721"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202004-656"
      }
    ],
    "trust": 0.7
  },
  "cve": "CVE-2020-11739",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "MEDIUM",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 6.9,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 3.4,
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "MEDIUM",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Medium",
            "accessVector": "Local",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "Complete",
            "baseScore": 6.9,
            "confidentialityImpact": "Complete",
            "exploitabilityScore": null,
            "id": "JVNDB-2020-004778",
            "impactScore": null,
            "integrityImpact": "Complete",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Medium",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 9.0,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "CNVD-2020-25869",
            "impactScore": 8.5,
            "integrityImpact": "PARTIAL",
            "severity": "HIGH",
            "trust": 0.6,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:C",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "MEDIUM",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "author": "VULMON",
            "availabilityImpact": "COMPLETE",
            "baseScore": 6.9,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 3.4,
            "id": "CVE-2020-11739",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "MEDIUM",
            "trust": 0.1,
            "userInteractionRequired": null,
            "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "author": "NVD",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 1.1,
            "impactScore": 6.0,
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "High",
            "attackVector": "Local",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 7.8,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "JVNDB-2020-004778",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "Low",
            "scope": "Changed",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2020-11739",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "JVNDB-2020-004778",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2020-25869",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202004-656",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULMON",
            "id": "CVE-2020-11739",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-25869"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-11739"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-004778"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-11739"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202004-656"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service or possibly gain privileges because of missing memory barriers in read-write unlock paths. The read-write unlock paths don\u0027t contain a memory barrier. On Arm, this means a processor is allowed to re-order the memory access with the preceding ones. In other words, the unlock may be seen by another processor before all the memory accesses within the \"critical\" section. As a consequence, it may be possible to have a writer executing a critical section at the same time as readers or another writer. In other words, many of the assumptions (e.g., a variable cannot be modified after a check) in the critical sections are not safe anymore. The read-write locks are used in hypercalls (such as grant-table ones), so a malicious guest could exploit the race. For instance, there is a small window where Xen can leak memory if XENMAPSPACE_grant_table is used concurrently. A malicious guest may be able to leak memory, or cause a hypervisor crash resulting in a Denial of Service (DoS). Information leak and privilege escalation cannot be excluded. Xen Exists in a buffer error vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. Xen is an open source virtual machine monitor product from the University of Cambridge. The product enables different and incompatible operating systems to run on the same computer and supports migration during runtime to ensure normal operation and avoid downtime. \n\r\n\r\nThere is a security vulnerability in Xen 4.13.x and previous versions. An attacker could use this vulnerability to cause a denial of service, possibly obtaining sensitive information or elevating permissions. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nGentoo Linux Security Advisory                           GLSA 202005-08\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n                                           https://security.gentoo.org/\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n Severity: Normal\n    Title: Xen: Multiple vulnerabilities\n     Date: May 14, 2020\n     Bugs: #717446\n       ID: 202005-08\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\nSynopsis\n========\n\nMultiple vulnerabilities have been found in Xen, the worst of which\ncould allow privilege escalation. \n\nBackground\n==========\n\nXen is a bare-metal hypervisor. \n\nAffected packages\n=================\n\n    -------------------------------------------------------------------\n     Package              /     Vulnerable     /            Unaffected\n    -------------------------------------------------------------------\n  1  app-emulation/xen          \u003c 4.12.2-r2              \u003e= 4.12.2-r2\n  2  app-emulation/xen-tools    \u003c 4.12.2-r2              \u003e= 4.12.2-r2\n    -------------------------------------------------------------------\n     2 affected packages\n\nDescription\n===========\n\nMultiple vulnerabilities have been discovered in Xen. Please review the\nCVE identifiers referenced below for details. \n\nImpact\n======\n\nPlease review the referenced CVE identifiers for details. \n\nWorkaround\n==========\n\nThere is no known workaround at this time. \n\nResolution\n==========\n\nAll Xen users should upgrade to the latest version:\n\n  # emerge --sync\n  # emerge --ask --oneshot --verbose \"\u003e=app-emulation/xen-4.12.2-r2\"\n\nReferences\n==========\n\n[ 1 ] CVE-2020-11739\n      https://nvd.nist.gov/vuln/detail/CVE-2020-11739\n[ 2 ] CVE-2020-11740\n      https://nvd.nist.gov/vuln/detail/CVE-2020-11740\n[ 3 ] CVE-2020-11741\n      https://nvd.nist.gov/vuln/detail/CVE-2020-11741\n[ 4 ] CVE-2020-11742\n      https://nvd.nist.gov/vuln/detail/CVE-2020-11742\n[ 5 ] CVE-2020-11743\n      https://nvd.nist.gov/vuln/detail/CVE-2020-11743\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n https://security.gentoo.org/glsa/202005-08\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users\u0027 machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2020 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttps://creativecommons.org/licenses/by-sa/2.5\n. \n      \nFor the stable distribution (buster), these problems have been fixed in\nversion 4.11.4+24-gddaaccbbab-1~deb10u1. \n\nWe recommend that you upgrade your xen packages. \n\nFor the detailed security status of xen please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/xen\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAl8Lc/AACgkQEMKTtsN8\nTjaMdxAAqGcAm1NI7JRg7LQprevLCPkxPItZapx3n/q/W6HwiGQxC6KP9Ntp3ArR\nQiIeIPzTWVMHcaahlgkLePaFPU3MCe5TkL0GKG1JIAD8JieKBSrAWJ6tqTiZx+G+\nanbksp/I9Mq9nciMlnPXeOVQgksoCB0tFYC2Ld+H7btZdD5G4KpJsz25c0S5poxW\nsIXLgNXIzmZcI8mVzUlt+w0FG3tnolr/kJppHBkgC46riVcy8LHRaRQiVTjwqjSn\nEop4oXxLDZ/qH8k+0JAZLtBPpc9PfQcLxCJnhH8z76QdPPkcJuNFx5zRXqr1dZfG\nAkRuG6LZa2tRGYzKZmo7BMj5dUei4xhDHLAoWGhSHkTmYtdc1Kyy4+duGPEChSCm\nfCSC1FhFJFK30iq918cunWtjhRrEqrJr10HuC+YlSXfqrv1Z12fPw3UPRJmdG2Dv\nUPS5vT8/NwF0osNrvNE+rkhYXTEKECE756pP3jTV4+BBBgf9DLtbV0EvYq1YWlJw\niT+KnzX9iW/jJg3bC32+UJlVv7IAkb8F9hcK3wKpvgSUVJIDWN352rfW7p8/xZoj\n7eIlmZwDPKWsyMlbt2OsyYQFQlBvNsk0+7ycu9hG6fBaF5ATSxTO+A43Q7OxorP9\ng8OhDVMgrx5GM4rXSZ60J6uxkd2eUns4Ud8pDGG8XTpnRBxD8Kk=\n=tfm7\n-----END PGP SIGNATURE-----\n. ==========================================================================\nUbuntu Security Notice USN-5617-1\nSeptember 19, 2022\n\nxen vulnerabilities\n==========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 20.04 LTS\n\nSummary:\n\nSeveral security issues were fixed in Xen. \n\nSoftware Description:\n- xen: Public headers and libs for Xen\n\nDetails:\n\nIt was discovered that memory contents previously stored in\nmicroarchitectural special registers after RDRAND, RDSEED, and SGX EGETKEY\nread operations on Intel client and Xeon E3 processors may be briefly\nexposed to processes on the same or different processor cores. (CVE-2020-0543)\n\nJulien Grall discovered that Xen incorrectly handled memory barriers on\nARM-based systems. \n(CVE-2020-11739)\n\nIlja Van Sprundel discovered that Xen incorrectly handled profiling of\nguests. (CVE-2020-11740, CVE-2020-11741)\n\nIt was discovered that Xen incorrectly handled grant tables. \n(CVE-2020-11742, CVE-2020-11743)\n\nJan Beulich discovered that Xen incorrectly handled certain code paths. \n(CVE-2020-15563)\n\nJulien Grall discovered that Xen incorrectly verified memory addresses\nprovided by the guest on ARM-based systems. (CVE-2020-15564)\n\nRoger Pau Monn\\xe9 discovered that Xen incorrectly handled caching on x86 Intel\nsystems. (CVE-2020-15565)\n\nIt was discovered that Xen incorrectly handled error in event-channel port\nallocation. (CVE-2020-15566)\n\nJan Beulich discovered that Xen incorrectly handled certain EPT (Extended\nPage Tables). (CVE-2020-15567)\n\nAndrew Cooper discovered that Xen incorrectly handled PCI passthrough. \n(CVE-2020-25595)\n\nAndrew Cooper discovered that Xen incorrectly sanitized path injections. \n(CVE-2020-25596)\n\nJan Beulich discovered that Xen incorrectly handled validation of event\nchannels. (CVE-2020-25597)\n\nJulien Grall and Jan Beulich discovered that Xen incorrectly handled\nresetting event channels. (CVE-2020-25599)\n\nJulien Grall discovered that Xen incorrectly handled event channels\nmemory allocation on 32-bits domains. (CVE-2020-25600)\n\nJan Beulich discovered that Xen incorrectly handled resetting or cleaning\nup event channels. (CVE-2020-25601)\n\nAndrew Cooper discovered that Xen incorrectly handled certain Intel\nspecific MSR (Model Specific Registers). (CVE-2020-25602)\n\nJulien Grall discovered that Xen incorrectly handled accessing/allocating\nevent channels. \n(CVE-2020-25603)\n\nIgor Druzhinin discovered that Xen incorrectly handled locks. (CVE-2020-25604)\n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 20.04 LTS:\n  libxendevicemodel1              4.11.3+24-g14b62ab3e5-1ubuntu2.3\n  libxenevtchn1                   4.11.3+24-g14b62ab3e5-1ubuntu2.3\n  libxengnttab1                   4.11.3+24-g14b62ab3e5-1ubuntu2.3\n  libxenmisc4.11                  4.11.3+24-g14b62ab3e5-1ubuntu2.3\n  xen-hypervisor-4.11-amd64       4.11.3+24-g14b62ab3e5-1ubuntu2.3\n  xen-hypervisor-4.11-arm64       4.11.3+24-g14b62ab3e5-1ubuntu2.3\n  xen-hypervisor-4.11-armhf       4.11.3+24-g14b62ab3e5-1ubuntu2.3\n  xen-utils-4.11                  4.11.3+24-g14b62ab3e5-1ubuntu2.3\n  xen-utils-common                4.11.3+24-g14b62ab3e5-1ubuntu2.3\n  xenstore-utils                  4.11.3+24-g14b62ab3e5-1ubuntu2.3\n\nAfter a standard system update you need to reboot your computer to make\nall the necessary changes. \n\nReferences:\n  https://ubuntu.com/security/notices/USN-5617-1\n  CVE-2020-0543, CVE-2020-11739, CVE-2020-11740, CVE-2020-11741,\n  CVE-2020-11742, CVE-2020-11743, CVE-2020-15563, CVE-2020-15564,\n  CVE-2020-15565, CVE-2020-15566, CVE-2020-15567, CVE-2020-25595,\n  CVE-2020-25596, CVE-2020-25597, CVE-2020-25599, CVE-2020-25600,\n  CVE-2020-25601, CVE-2020-25602, CVE-2020-25603, CVE-2020-25604\n\nPackage Information:\n  https://launchpad.net/ubuntu/+source/xen/4.11.3+24-g14b62ab3e5-1ubuntu2.3\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2020-11739"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-004778"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2020-25869"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-11739"
      },
      {
        "db": "PACKETSTORM",
        "id": "157721"
      },
      {
        "db": "PACKETSTORM",
        "id": "168871"
      },
      {
        "db": "PACKETSTORM",
        "id": "168421"
      }
    ],
    "trust": 2.52
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2020-11739",
        "trust": 3.4
      },
      {
        "db": "OPENWALL",
        "id": "OSS-SECURITY/2020/04/14/2",
        "trust": 2.5
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-004778",
        "trust": 0.8
      },
      {
        "db": "PACKETSTORM",
        "id": "157721",
        "trust": 0.7
      },
      {
        "db": "PACKETSTORM",
        "id": "168421",
        "trust": 0.7
      },
      {
        "db": "CNVD",
        "id": "CNVD-2020-25869",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.1463",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.1575",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2022.4642",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.2813",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.2364",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.1317",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202004-656",
        "trust": 0.6
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-11739",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "168871",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-25869"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-11739"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-004778"
      },
      {
        "db": "PACKETSTORM",
        "id": "157721"
      },
      {
        "db": "PACKETSTORM",
        "id": "168871"
      },
      {
        "db": "PACKETSTORM",
        "id": "168421"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-11739"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202004-656"
      }
    ]
  },
  "id": "VAR-202004-0243",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-25869"
      }
    ],
    "trust": 0.06
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "Network device"
        ],
        "sub_category": null,
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-25869"
      }
    ]
  },
  "last_update_date": "2023-12-18T11:19:48.777000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "FEDORA-2020-295ed0b1e0",
        "trust": 0.8,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5m2xrnchoggtjqbzqj7dcv6znakn3le2/"
      },
      {
        "title": "FEDORA-2020-cbc3149753",
        "trust": 0.8,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/nvtp4oyhctru3onfjofjqvndfb25kllg/"
      },
      {
        "title": "FEDORA-2020-440457afe4",
        "trust": 0.8,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ymaw7d2mp6re4bfi5bzwobbwgy3vsofn/"
      },
      {
        "title": "XSA-314",
        "trust": 0.8,
        "url": "https://xenbits.xen.org/xsa/advisory-314.html"
      },
      {
        "title": "Patch for Xen Denial of Service Vulnerability (CNVD-2020-25869)",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchinfo/show/216031"
      },
      {
        "title": "Xen Security vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=113686"
      },
      {
        "title": "Debian Security Advisories: DSA-4723-1 xen -- security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories\u0026qid=0d177f74e6265e2fdbb8df6fa6c636bf"
      },
      {
        "title": "Ubuntu Security Notice: USN-5617-1: Xen vulnerabilities",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=usn-5617-1"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-25869"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-11739"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-004778"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202004-656"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-362",
        "trust": 1.0
      },
      {
        "problemtype": "CWE-119",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-004778"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-11739"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 3.4,
        "url": "http://xenbits.xen.org/xsa/advisory-314.html"
      },
      {
        "trust": 2.5,
        "url": "http://www.openwall.com/lists/oss-security/2020/04/14/2"
      },
      {
        "trust": 1.8,
        "url": "https://security.gentoo.org/glsa/202005-08"
      },
      {
        "trust": 1.8,
        "url": "https://www.debian.org/security/2020/dsa-4723"
      },
      {
        "trust": 1.7,
        "url": "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00006.html"
      },
      {
        "trust": 1.7,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-11739"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5m2xrnchoggtjqbzqj7dcv6znakn3le2/"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/nvtp4oyhctru3onfjofjqvndfb25kllg/"
      },
      {
        "trust": 1.0,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ymaw7d2mp6re4bfi5bzwobbwgy3vsofn/"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-11739"
      },
      {
        "trust": 0.7,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ymaw7d2mp6re4bfi5bzwobbwgy3vsofn/"
      },
      {
        "trust": 0.7,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5m2xrnchoggtjqbzqj7dcv6znakn3le2/"
      },
      {
        "trust": 0.7,
        "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/nvtp4oyhctru3onfjofjqvndfb25kllg/"
      },
      {
        "trust": 0.6,
        "url": "https://www.suse.com/support/update/announcement/2020/suse-su-20202234-1"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.1317/"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/168421/ubuntu-security-notice-usn-5617-1.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.2813/"
      },
      {
        "trust": 0.6,
        "url": "https://access.redhat.com/security/cve/cve-2020-11739"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2022.4642"
      },
      {
        "trust": 0.6,
        "url": "https://vigilance.fr/vulnerability/xen-information-disclosure-via-read-write-unlock-paths-32009"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.1463/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.2364/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.1575/"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/157721/gentoo-linux-security-advisory-202005-08.html"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-11742"
      },
      {
        "trust": 0.2,
        "url": "https://ubuntu.com/security/notices/usn-5617-1"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-11743"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-11741"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-11740"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15564"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15566"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15567"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15563"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-15565"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/362.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "http://seclists.org/oss-sec/2020/q2/23"
      },
      {
        "trust": 0.1,
        "url": "https://bugs.gentoo.org."
      },
      {
        "trust": 0.1,
        "url": "https://creativecommons.org/licenses/by-sa/2.5"
      },
      {
        "trust": 0.1,
        "url": "https://security.gentoo.org/"
      },
      {
        "trust": 0.1,
        "url": "https://www.debian.org/security/faq"
      },
      {
        "trust": 0.1,
        "url": "https://security-tracker.debian.org/tracker/xen"
      },
      {
        "trust": 0.1,
        "url": "https://www.debian.org/security/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-25596"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-25601"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-25597"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/xen/4.11.3+24-g14b62ab3e5-1ubuntu2.3"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-25595"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-25599"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-25600"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-0543"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2020-11739"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-004778"
      },
      {
        "db": "PACKETSTORM",
        "id": "157721"
      },
      {
        "db": "PACKETSTORM",
        "id": "168871"
      },
      {
        "db": "PACKETSTORM",
        "id": "168421"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-11739"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202004-656"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CNVD",
        "id": "CNVD-2020-25869"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-11739"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-004778"
      },
      {
        "db": "PACKETSTORM",
        "id": "157721"
      },
      {
        "db": "PACKETSTORM",
        "id": "168871"
      },
      {
        "db": "PACKETSTORM",
        "id": "168421"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-11739"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202004-656"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2020-04-30T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2020-25869"
      },
      {
        "date": "2020-04-14T00:00:00",
        "db": "VULMON",
        "id": "CVE-2020-11739"
      },
      {
        "date": "2020-05-27T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2020-004778"
      },
      {
        "date": "2020-05-15T14:52:42",
        "db": "PACKETSTORM",
        "id": "157721"
      },
      {
        "date": "2020-07-28T19:12:00",
        "db": "PACKETSTORM",
        "id": "168871"
      },
      {
        "date": "2022-09-19T18:26:25",
        "db": "PACKETSTORM",
        "id": "168421"
      },
      {
        "date": "2020-04-14T13:15:12.703000",
        "db": "NVD",
        "id": "CVE-2020-11739"
      },
      {
        "date": "2020-04-14T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202004-656"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2020-04-30T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2020-25869"
      },
      {
        "date": "2022-05-03T00:00:00",
        "db": "VULMON",
        "id": "CVE-2020-11739"
      },
      {
        "date": "2020-05-27T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2020-004778"
      },
      {
        "date": "2023-11-07T03:15:04.020000",
        "db": "NVD",
        "id": "CVE-2020-11739"
      },
      {
        "date": "2022-09-21T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202004-656"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "local",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "168421"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202004-656"
      }
    ],
    "trust": 0.7
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Xen Buffer error vulnerability in",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-004778"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "competition condition problem",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202004-656"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.