CVEvulnerability
CVE-2020-27674
5.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2020-10-22
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.3 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- CVSS 2.0 ([email protected])
- 4.6 MEDIUM — AV:L/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-787
Description
An issue was discovered in Xen through 4.14.x allowing x86 PV guest OS users to gain guest OS privileges by modifying kernel memory contents, because invalidation of TLB entries is mishandled during use of an INVLPG-like attack technique.
Affected configurations
• xen xen (<= 4.14.0)
• fedoraproject fedora 31
• fedoraproject fedora 32
• fedoraproject fedora 33
• debian debian linux 10.0
Related
Weakness · CWE (1)
- CWE-787 Out-of-bounds Write weakness
References
- http://www.openwall.com/lists/oss-security/2021/01/19/5 Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZAM3LYJ5TZLSSNL3KXFILM46QKVTOUA/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3U4LNKKXU4UP4Z5XP6TMIWSML3QODPE/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XIK57QJOVOPWH6RFRNMGOBCROBCKMDG2/ lists.fedoraproject.org
- https://security.gentoo.org/glsa/202011-06 Third Party Advisory
- https://www.debian.org/security/2020/dsa-4804 Third Party Advisory
- https://xenbits.xen.org/xsa/advisory-286.html Patch, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2021/01/19/5 Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZAM3LYJ5TZLSSNL3KXFILM46QKVTOUA/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3U4LNKKXU4UP4Z5XP6TMIWSML3QODPE/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XIK57QJOVOPWH6RFRNMGOBCROBCKMDG2/ lists.fedoraproject.org
- https://security.gentoo.org/glsa/202011-06 Third Party Advisory
- https://www.debian.org/security/2020/dsa-4804 Third Party Advisory
- https://xenbits.xen.org/xsa/advisory-286.html Patch, Vendor Advisory