CVEvulnerability
CVE-2020-11740
5.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2020-04-14
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 2.1 LOW — AV:L/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-212
Description
An issue was discovered in xenoprof in Xen through 4.13.x, allowing guest OS users (without active profiling) to obtain sensitive information about other guests. Unprivileged guests can request to map xenoprof buffers, even if profiling has not been enabled for those guests. These buffers were not scrubbed.
Affected configurations
• xen xen (>= 3.2.0 <= 4.13.0)
• xen xen 4.13.0
• debian debian linux 10.0
• fedoraproject fedora 30
• fedoraproject fedora 31
• fedoraproject fedora 32
• opensuse leap 15.1
Related
Weakness · CWE (1)
- CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer weakness
References
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00006.html Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2020/04/14/1 Mailing List, Patch, Third Party Advisory
- http://xenbits.xen.org/xsa/advisory-313.html Patch, Vendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5M2XRNCHOGGTJQBZQJ7DCV6ZNAKN3LE2/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NVTP4OYHCTRU3ONFJOFJQVNDFB25KLLG/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YMAW7D2MP6RE4BFI5BZWOBBWGY3VSOFN/ lists.fedoraproject.org
- https://security.gentoo.org/glsa/202005-08 Third Party Advisory
- https://www.debian.org/security/2020/dsa-4723 Third Party Advisory
- https://xenbits.xen.org/xsa/advisory-313.html Patch, Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00006.html Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2020/04/14/1 Mailing List, Patch, Third Party Advisory
- http://xenbits.xen.org/xsa/advisory-313.html Patch, Vendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5M2XRNCHOGGTJQBZQJ7DCV6ZNAKN3LE2/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NVTP4OYHCTRU3ONFJOFJQVNDFB25KLLG/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YMAW7D2MP6RE4BFI5BZWOBBWGY3VSOFN/ lists.fedoraproject.org
- https://security.gentoo.org/glsa/202005-08 Third Party Advisory
- https://www.debian.org/security/2020/dsa-4723 Third Party Advisory
- https://xenbits.xen.org/xsa/advisory-313.html Patch, Vendor Advisory