SB2020041910 - Improper Handling of Exceptional Conditions in xen (Alpine package)

Description

This security bulletin contains information about 1 security vulnerability.

1) Improper Handling of Exceptional Conditions (CVE-ID: CVE-2020-11743)

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service because of a bad error path in GNTTABOP_map_grant. Grant table operations are expected to return 0 for success, and a negative number for errors. Some misplaced brackets cause one error path to return 1 instead of a negative value. The grant table code in Linux treats this condition as success, and proceeds with incorrectly initialised state. A buggy or malicious guest can construct its grant table in such a way that, when a backend domain tries to map a grant, it hits the incorrect error path. This will crash a Linux based dom0 or backend domain.

Remediation

Install update from vendor's website.

References

• https://git.alpinelinux.org/aports/commit/?id=5c40dfc3f9763d20de339d8f1b694b48631d253b
• https://git.alpinelinux.org/aports/commit/?id=7c4c7fb75cb36f33395f8a86ae820e4fb9f8d59e
• https://git.alpinelinux.org/aports/commit/?id=95332e4ed106c72d58a0a5490d0f608e3d76b83e
• https://git.alpinelinux.org/aports/commit/?id=fa008233b860d6652d640df8ed23f5bdd8e42b9b
• https://git.alpinelinux.org/aports/commit/?id=05b5ec57508952a3bf13538e1f72d2a5e9357796