SB2020092333 - Use of uninitialized resource in xen (Alpine package)
Published: September 23, 2020
Security Bulletin ID
SB2020092333
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Use of uninitialized resource (CVE-ID: CVE-2020-25595)
The vulnerability allows a remote user to escalate privileges on the host operating system.
The vulnerability exists due to PCI passthrough code reading back untrusted values fromhardware registers in Xen. A remote user on a guest operating system can run a specially crafted program to obtain potentially sensitive information from memory and crash Xen or escalate privileges on the hypervisor.
The vulnerability affects x86 systems with PCI passthrough support.
Remediation
Install update from vendor's website.