CVE-2020-15564

描述

An issue was discovered in Xen through 4.13.x, allowing Arm guest OS users to cause a hypervisor crash because of a missing alignment check in VCPUOP_register_vcpu_info. The hypercall VCPUOP_register_vcpu_info is used by a guest to register a shared region with the hypervisor. The region will be mapped into Xen address space so it can be directly accessed. On Arm, the region is accessed with instructions that require a specific alignment. Unfortunately, there is no check that the address provided by the guest will be correctly aligned. As a result, a malicious guest could cause a hypervisor crash by passing a misaligned address. A malicious guest administrator may cause a hypervisor crash, resulting in a Denial of Service (DoS). All Xen versions are vulnerable. Only Arm systems are vulnerable. x86 systems are not affected.

如何修補 CVE-2020-15564

要修補 CVE-2020-15564,請將受影響套件升級到下列已修補版本。

• —升級至 4.12.3-r2 或更新版本

CVE-2020-15564 正在被利用嗎?

低 — EPSS 為 0.4%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• >= 4.8.0, < 4.12.3-r2

CVSS 分數

參考連結(1)

• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2020-15564