CVE-2020-27671

An issue was discovered in Xen through 4.14.x allowing x86 HVM and PVH guest OS users to cause a denial of service (data corruption), cause a data leak, or possibly gain privileges because coalescing of per-page IOMMU TLB flushes is mishandled.

Published: Oct 22, 2020
Updated: Apr 14, 2023
CVE: CVE-2020-27671
Severity: High
Exploit:

CVSS v3:

Severity: High
Score: 7.8
AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

CVSS v2:

Severity: Medium
Score: 6.9
AV:L/AC:M/Au:N/C:C/I:C/A:C

No CWE or OWASP classifications available.

Affected Software
References

Software	From	Fixed in
xen / xen	4.2.0	4.14.0.x
opensuse / leap	15.1	15.1.x
opensuse / leap	15.2	15.2.x
debian / debian_linux	10.0	10.0.x
fedoraproject / fedora	31	31.x

http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00075.html
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00025.html
http://www.openwall.com/lists/oss-security/2021/01/19/8
http://xenbits.xen.org/xsa/advisory-346.html
https://lists.fedoraproject.org/archives/list/[email protected]/message/XIK57QJOVOPWH6RFRNMGOBCROBCKMDG2/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XIK57QJOVOPWH6RFRNMGOBCROBCKMDG2/
https://security.gentoo.org/glsa/202011-06
https://www.debian.org/security/2020/dsa-4804
https://xenbits.xen.org/xsa/advisory-346.html

Vulnerability Database

289,599

CVE-2020-27671