SB2021012418 - Insufficient verification of data authenticity in xen (Alpine package)
Published: January 24, 2021
Security Bulletin ID
SB2021012418
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Insufficient verification of data authenticity (CVE-ID: CVE-2020-27670)
The vulnerability allows a local authenticated user to execute arbitrary code.
An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a denial of service (data corruption), cause a data leak, or possibly gain privileges because an AMD IOMMU page-table entry can be half-updated.
Remediation
Install update from vendor's website.
References
- https://git.alpinelinux.org/aports/commit/?id=b7415ec9fb42dde32333fbc1e4575f6bcf11cb32
- https://git.alpinelinux.org/aports/commit/?id=7c351cb852f0cee887b3fcb3a76be20f51350a1a
- https://git.alpinelinux.org/aports/commit/?id=b47f6b6f2e6b179714227cc362a24b0bdb78a028
- https://git.alpinelinux.org/aports/commit/?id=7335a7d4162b6694682183dfea682f282843d5f3
- https://git.alpinelinux.org/aports/commit/?id=91c8694f2fdbc9ff757dc2f658107b9a87428d10