CVE-2020-11743

Description

An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service because of a bad error path in GNTTABOP_map_grant. Grant table operations are expected to return 0 for success, and a negative number for errors. Some misplaced brackets cause one error path to return 1 instead of a negative value. The grant table code in Linux treats this condition as success, and proceeds with incorrectly initialised state. A buggy or malicious guest can construct its grant table in such a way that, when a backend domain tries to map a grant, it hits the incorrect error path. This will crash a Linux based dom0 or backend domain.

Risk Information

Base Score

5.5

MODERATE

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Score

Exploitation Probability

0.094

Associated Vulnerability

Vulnerability	OS Platform
SUSE-SU-2020:1138-1(SUSE Linux Enterprise Server 12-SP4 ) xen-4.11.3_04-2.23.1.x86_64.rpm	Linux
SUSE-SU-2020:1138-1(SUSE Linux Enterprise Server 12-SP4 ) xen-debugsource-4.11.3_04-2.23.1.x86_64.rpm	Linux
SUSE-SU-2020:1138-1(SUSE Linux Enterprise Server 12-SP4 ) xen-doc-html-4.11.3_04-2.23.1.x86_64.rpm	Linux
SUSE-SU-2020:1138-1(SUSE Linux Enterprise Server 12-SP4 ) xen-libs-4.11.3_04-2.23.1.x86_64.rpm	Linux
SUSE-SU-2020:1138-1(SUSE Linux Enterprise Server 12-SP4 ) xen-libs-32bit-4.11.3_04-2.23.1.x86_64.rpm	Linux
SUSE-SU-2020:1138-1(SUSE Linux Enterprise Server 12-SP4 ) xen-libs-debuginfo-4.11.3_04-2.23.1.x86_64.rpm	Linux
SUSE-SU-2020:1138-1(SUSE Linux Enterprise Server 12-SP4 ) xen-libs-debuginfo-32bit-4.11.3_04-2.23.1.x86_64.rpm	Linux
SUSE-SU-2020:1138-1(SUSE Linux Enterprise Server 12-SP4 ) xen-tools-4.11.3_04-2.23.1.x86_64.rpm	Linux
SUSE-SU-2020:1138-1(SUSE Linux Enterprise Server 12-SP4 ) xen-tools-debuginfo-4.11.3_04-2.23.1.x86_64.rpm	Linux
SUSE-SU-2020:1138-1(SUSE Linux Enterprise Server 12-SP4 ) xen-tools-domU-4.11.3_04-2.23.1.x86_64.rpm	Linux
SUSE-SU-2020:1138-1(SUSE Linux Enterprise Server 12-SP4 ) xen-tools-domU-debuginfo-4.11.3_04-2.23.1.x86_64.rpm	Linux
Public headers and libs for Xen (USN-5617-1) libxenevtchn1_4.11.3+24-g14b62ab3e5-1ubuntu2.3_amd64.deb	Linux
Public headers and libs for Xen (USN-5617-1) libxengnttab1_4.11.3+24-g14b62ab3e5-1ubuntu2.3_amd64.deb	Linux
Public headers and libs for Xen (USN-5617-1) libxenmisc4.11_4.11.3+24-g14b62ab3e5-1ubuntu2.3_amd64.deb	Linux
Public headers and libs for Xen (USN-5617-1) xen-utils-4.11_4.11.3+24-g14b62ab3e5-1ubuntu2.3_amd64.deb	Linux
Public headers and libs for Xen (USN-5617-1) xenstore-utils_4.11.3+24-g14b62ab3e5-1ubuntu2.3_amd64.deb	Linux
Public headers and libs for Xen (USN-5617-1) xen-utils-common_4.11.3+24-g14b62ab3e5-1ubuntu2.3_amd64.deb	Linux
Public headers and libs for Xen (USN-5617-1) libxendevicemodel1_4.11.3+24-g14b62ab3e5-1ubuntu2.3_amd64.deb	Linux
Public headers and libs for Xen (USN-5617-1) xen-hypervisor-4.11-amd64_4.11.3+24-g14b62ab3e5-1ubuntu2.3_amd64.deb	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234