CVE-2020-29486

Katalog CVE

CVSS 6.0 · Medium EPSS 0,41%

Kerentanan Allocation of Resources Without Limits or Throttling pada xen, debian linux +1 lainnya. Skor CVSS 3.1 6.0 (Medium) menurut NVD.

Deskripsi (NVD)

An issue was discovered in Xen through 4.14.x. Nodes in xenstore have an ownership. In oxenstored, a owner could give a node away. However, node ownership has quota implications. Any guest can run another guest out of quota, or create an unbounded number of nodes owned by dom0, thus running xenstored out of memory A malicious guest administrator can cause a denial of service against a specific guest or against the whole host. All systems using oxenstored are vulnerable. Building and using oxenstored is the default in the upstream Xen distribution, if the Ocaml compiler is available. Systems using C xenstored are not vulnerable.

Rincian

Terbit di NVD

15 Desember 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.0 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 33,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://xenbits.xenproject.org/xsa/advisory-352.html patch · advisory vendor
• https://security.gentoo.org/glsa/202107-30 advisory pihak ketiga
• https://www.debian.org/security/2020/dsa-4812 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2C6M6S3CIMEBA...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OBLV6L6Q24PPQ...