CVE-2020-29487

{"id": "CVE-2020-29487", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2020-12-15T18:15:15.663", "references": [{"url": "https://security.gentoo.org/glsa/202107-30", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://xenbits.xenproject.org/xsa/advisory-354.html", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Xen XAPI before 2020-12-15. Certain xenstore keys provide feedback from the guest, and are therefore watched by toolstack. Specifically, keys are watched by xenopsd, and data are forwarded via RPC through message-switch to xapi. The watching logic in xenopsd sends one RPC update containing all data, any time any single xenstore key is updated, and therefore has O(N^2) time complexity. Furthermore, message-switch retains recent (currently 128) RPC messages for diagnostic purposes, yielding O(M*N) space complexity. The quantity of memory a single guest can monopolise is bounded by xenstored quota, but the quota is fairly large. It is believed to be in excess of 1G per malicious guest. In practice, this manifests as a host denial of service, either through message-switch thrashing against swap, or OOMing entirely, depending on dom0's configuration. (There are no quotas in xenopsd to limit the quantity of keys that result in RPC traffic.) A buggy or malicious guest can cause unreasonable memory usage in dom0, resulting in a host denial of service. All versions of XAPI are vulnerable. Systems that are not using the XAPI toolstack are not vulnerable."}, {"lang": "es", "value": "Se detect\u00f3 un problema en Xen XAPI antes del 15/12/2020. Determinadas claves de xenstore proporcionan comentarios del invitado y, por lo tanto, son supervisadas por toolstack. Espec\u00edficamente, las claves son supervisadas por xenopsd y los datos son reenviados por medio de RPC mediante message-switch hacia xapi. La l\u00f3gica de observaci\u00f3n en xenopsd env\u00eda una actualizaci\u00f3n RPC que contiene todos los datos, cada vez que una sola clave de xenstore es actualizada y, por lo tanto, presenta una complejidad de tiempo O(N^2). Adem\u00e1s, message-switch conserva los mensajes RPC recientes (actualmente 128) con prop\u00f3sitos de diagn\u00f3stico, lo que genera una complejidad de espacio O(M*N). La cantidad de memoria que un solo invitado puede monopolizar est\u00e1 limitada por la cuota almacenada en xen, pero la cuota es bastante grande. Se cree que supera 1G por invitado malicioso. En la pr\u00e1ctica, esto se manifiesta como una denegaci\u00f3n de servicio del host, ya sea a trav\u00e9s de message-switch contra el intercambio, o mediante OOM por completo, dependiendo de la configuraci\u00f3n de dom0. (No existen cuotas en xenopsd para limitar la cantidad de claves que resultan en tr\u00e1fico RPC.) Un invitado con errores o malicioso puede causar un uso de memoria irrazonable en dom0, resultando en una denegaci\u00f3n de servicio del host. Todas las versiones de XAPI son vulnerables. Los sistemas que no est\u00e1n usando la toolstack de XAPI no son vulnerables"}], "lastModified": "2021-12-10T02:12:08.497", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:xen:xapi:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E60C15D4-5A84-4767-A567-E02FEBCB60EC", "versionEndExcluding": "2020-12-15"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}