CVE-2020-27670: xen +3 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2020-27670

CVSS 7.8 · High EPSS 0,25%

Kerentanan Insufficient Verification of Data Authenticity pada xen, opensuse leap +2 lainnya. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a denial of service (data corruption), cause a data leak, or possibly gain privileges because an AMD IOMMU page-table entry can be half-updated.

Rincian

Terbit di NVD: 22 Oktober 2020
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-345: Insufficient Verification of Data Authenticity
EPSS (30 hari): 0,25% peluang dieksploitasi; lebih tinggi dari 15,6% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
xen	xen	Semua versi hingga 4.14.0
opensuse	leap	Versi 15.1
opensuse	leap	Versi 15.2
fedoraproject	fedora	Versi 31
debian	debian linux	Versi 10.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

http://xenbits.xen.org/xsa/advisory-347.html patch · advisory vendor
https://xenbits.xen.org/xsa/advisory-347.html patch · advisory vendor
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00075.html mailing list · advisory pihak ketiga
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00025.html mailing list · advisory pihak ketiga
http://www.openwall.com/lists/oss-security/2021/01/19/9 mailing list · advisory pihak ketiga
https://security.gentoo.org/glsa/202011-06 advisory pihak ketiga
https://www.debian.org/security/2020/dsa-4804 advisory pihak ketiga
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XIK57QJOVOPWH...

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.