CVEvulnerability
CVE-2020-28368
4.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2020-11-10
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 4.4 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 2.1 LOW — AV:L/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-862
Description
Xen through 4.14.x allows guest OS administrators to obtain sensitive information (such as AES keys from outside the guest) via a side-channel attack on a power/energy monitoring interface, aka a "Platypus" attack. NOTE: there is only one logically independent fix: to change the access control for each such interface in Xen.
Affected configurations
• xen xen (<= 4.14.0)
• fedoraproject fedora 32
• debian debian linux 10.0
Related
Weakness · CWE (1)
- CWE-862 Missing Authorization weakness
Referenced by CWE · observed example (1)
- CWE-1300 Improper Protection of Physical Side Channels weakness
References
- http://www.openwall.com/lists/oss-security/2020/11/26/1 Mailing List, Third Party Advisory
- http://xenbits.xen.org/xsa/advisory-351.html Vendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5J66QUUHXH2RR4CNCKQRGVXVSOUFRPDA/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XV23EZIMNLJN4YXRRXLQV2ALW6ZEALXV/ lists.fedoraproject.org
- https://platypusattack.com Third Party Advisory
- https://www.debian.org/security/2020/dsa-4804 Mailing List, Third Party Advisory
- https://www.zdnet.com/article/new-platypus-attack-can-steal-data-from-intel-cpus/ Third Party Advisory
- https://xenbits.xen.org/xsa/advisory-351.html Patch, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2020/11/26/1 Mailing List, Third Party Advisory
- http://xenbits.xen.org/xsa/advisory-351.html Vendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5J66QUUHXH2RR4CNCKQRGVXVSOUFRPDA/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XV23EZIMNLJN4YXRRXLQV2ALW6ZEALXV/ lists.fedoraproject.org
- https://platypusattack.com Third Party Advisory
- https://www.debian.org/security/2020/dsa-4804 Mailing List, Third Party Advisory
- https://www.zdnet.com/article/new-platypus-attack-can-steal-data-from-intel-cpus/ Third Party Advisory
- https://xenbits.xen.org/xsa/advisory-351.html Patch, Vendor Advisory