{"id":"CVE-2020-11739","aliases":["ALPINE-CVE-2020-11739","DEBIAN-CVE-2020-11739","DSA-4723-1","EUVD-2020-4081","GHSA-5wwp-3576-jfjc","SUSE-SU-2020:1124-1","SUSE-SU-2020:1138-1","SUSE-SU-2020:1139-1","SUSE-SU-2020:1630-1","SUSE-SU-2020:1634-1","SUSE-SU-2020:2234-1","UBUNTU-CVE-2020-11739","USN-5617-1","openSUSE-SU-2020:0599-1","openSUSE-SU-2024:11520-1"],"status":"published","title":"An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of...","description":"An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service or possibly gain privileges because of missing memory barriers in read-write unlock paths. The read-write unlock paths don't contain a memory barrier. On Arm, this means a processor is allowed to re-order the memory access with the preceding ones. In other words, the unlock may be seen by another processor before all the memory accesses within the \"critical\" section. As a consequence, it may be possible to have a writer executing a critical section at the same time as readers or another writer. In other words, many of the assumptions (e.g., a variable cannot be modified after a check) in the critical sections are not safe anymore. The read-write locks are used in hypercalls (such as grant-table ones), so a malicious guest could exploit the race. For instance, there is a small window where Xen can leak memory if XENMAPSPACE_grant_table is used concurrently. A malicious guest may be able to leak memory, or cause a hypervisor crash resulting in a Denial of Service (DoS). Information leak and privilege escalation cannot be excluded.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00288,"percentile":0.21487,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119","CWE-362"],"published":"2020-04-14T12:17:49Z","modified":"2026-10-26T12:01:22Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"xen","fixed_in":["4.12.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"xen","fixed_in":["4.13.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"xen","fixed_in":["4.13.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"xen","fixed_in":["4.13.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"xen","fixed_in":["4.13.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"xen","fixed_in":["4.13.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"xen","fixed_in":["4.13.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"xen","fixed_in":["4.13.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"xen","fixed_in":["4.13.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"xen","fixed_in":["4.13.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"xen","fixed_in":["4.13.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"xen","fixed_in":["4.13.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"xen","fixed_in":["4.13.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"xen","fixed_in":["4.13.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"xen","fixed_in":["4.13.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"xen","fixed_in":["4.10.4-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"xen","fixed_in":["4.11.3-r2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"xen","fixed_in":["4.11.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xen","fixed_in":["4.11.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xen","fixed_in":["4.11.4-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"xen","fixed_in":["4.11.3+24-g14b62ab3e5-1ubuntu2.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.4-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11.3-r2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11.4-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11.4+24-gddaaccbbab-1~deb10u1"}]}],"versions":["4.11.1+92-g6c33308a8d-2","4.11.3+24-g14b62ab3e5-1","4.11.3+24-g14b62ab3e5-1~deb10u1","4.11.4-1"],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.2_04-3.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.2_04-3.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11.3_04-2.23.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11.3_04-2.23.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11.3_04-2.23.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.2_04-3.11.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.2_04-3.11.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.2_04-3.11.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.4_06-3.62.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.4_06-3.62.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.4_06-3.62.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.4_06-3.62.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.4_06-3.62.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.4_06-3.62.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.4_06-3.62.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.4_10-3.31.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.4_10-3.31.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.4_10-3.31.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.6_08-43.64.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.6_08-43.64.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.6_08-43.64.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.6_08-43.64.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5.1-0ubuntu1","4.5.1-0ubuntu2","4.6.0-1ubuntu1","4.6.0-1ubuntu2","4.6.0-1ubuntu4","4.6.0-1ubuntu4.1","4.6.0-1ubuntu4.2","4.6.0-1ubuntu4.3","4.6.5-0ubuntu1","4.6.5-0ubuntu1.1","4.6.5-0ubuntu1.2","4.6.5-0ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.9.0-0ubuntu3","4.9.0-0ubuntu4","4.9.2-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11.3+24-g14b62ab3e5-1ubuntu2.3"}]}],"versions":["4.9.2-0ubuntu2","4.9.2-0ubuntu6","4.9.2-0ubuntu7","4.11.3+24-g14b62ab3e5-1ubuntu1","4.11.3+24-g14b62ab3e5-1ubuntu2","4.11.3+24-g14b62ab3e5-1ubuntu2.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11.3+24-g14b62ab3e5-1ubuntu2.3"}]}],"versions":["4.9.2-0ubuntu2","4.9.2-0ubuntu6","4.9.2-0ubuntu7","4.11.3+24-g14b62ab3e5-1ubuntu1","4.11.3+24-g14b62ab3e5-1ubuntu2","4.11.3+24-g14b62ab3e5-1ubuntu2.2"],"bundled":20},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.2_04-lp151.2.15.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.1_01-1.2"}]}],"bundled":93}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"opensuse","product":"leap"},{"vendor":"xen","product":"xen"}],"references":[{"url":"https://xenbits.xen.org/xsa/advisory-314.html","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix","report"]},{"url":"http://xenbits.xen.org/xsa/advisory-314.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix","report"]},{"url":"http://www.openwall.com/lists/oss-security/2020/04/14/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","fix","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YMAW7D2MP6RE4BFI5BZWOBBWGY3VSOFN/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5M2XRNCHOGGTJQBZQJ7DCV6ZNAKN3LE2/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00006.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NVTP4OYHCTRU3ONFJOFJQVNDFB25KLLG/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202005-08","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2020/dsa-4723","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11739"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5M2XRNCHOGGTJQBZQJ7DCV6ZNAKN3LE2/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NVTP4OYHCTRU3ONFJOFJQVNDFB25KLLG/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YMAW7D2MP6RE4BFI5BZWOBBWGY3VSOFN/"},{"url":"https://github.com/advisories/GHSA-5wwp-3576-jfjc"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-11739","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-11739","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201124-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1027519","tags":["report"]},{"url":"https://bugzilla.suse.com/1134506","tags":["report"]},{"url":"https://bugzilla.suse.com/1155200","tags":["report"]},{"url":"https://bugzilla.suse.com/1157490","tags":["report"]},{"url":"https://bugzilla.suse.com/1160932","tags":["report"]},{"url":"https://bugzilla.suse.com/1165206","tags":["report"]},{"url":"https://bugzilla.suse.com/1167007","tags":["report"]},{"url":"https://bugzilla.suse.com/1167152","tags":["report"]},{"url":"https://bugzilla.suse.com/1168140","tags":["report"]},{"url":"https://bugzilla.suse.com/1168142","tags":["report"]},{"url":"https://bugzilla.suse.com/1168143","tags":["report"]},{"url":"https://bugzilla.suse.com/1169392","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11741","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11742","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11743","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201138-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1161181","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7211","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201139-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1162040","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201630-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1157888","tags":["report"]},{"url":"https://bugzilla.suse.com/1158003","tags":["report"]},{"url":"https://bugzilla.suse.com/1158004","tags":["report"]},{"url":"https://bugzilla.suse.com/1158005","tags":["report"]},{"url":"https://bugzilla.suse.com/1158006","tags":["report"]},{"url":"https://bugzilla.suse.com/1158007","tags":["report"]},{"url":"https://bugzilla.suse.com/1172205","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19577","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19578","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19579","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19581","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19583","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-0543","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201634-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202234-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1163019","tags":["report"]},{"url":"https://bugzilla.suse.com/1174543","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8608","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-11739","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5617-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-11739","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-0543","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-11740","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-11741","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-11742","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-11743","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-15563","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-15564","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-15565","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-15566","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-15567","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-25595","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-25596","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-25597","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-25599","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-25600","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-25601","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-25602","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-25603","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-25604","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/UOGIHSVHR5GUF43UV76QYSDRKANB2S5G/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2007-1320","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-1366","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10025","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8667","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8910","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9932","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12137","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8309","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9330","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10472","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12892","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12893","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15470","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19966","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19967","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3639","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3646","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7540","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7541","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15565","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15567","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25596","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25598","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25599","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25604","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27670","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27671","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27672","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-28368","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29480","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29483","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29484","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29567","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29570","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28687","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-11739","description":"An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service or possibly gain privileges because of missing memory barriers in read-write unlock paths. The read-write unlock paths don't contain a memory barrier. On Arm, this means a processor is allowed to re-order the memory access with the preceding ones. In other words, the unlock may be seen by another processor before all the memory accesses within the \"critical\" section. As a consequence, it may be possible to have a writer executing a critical section at the same time as readers or another writer. In other words, many of the assumptions (e.g., a variable cannot be modified after a check) in the critical sections are not safe anymore. The read-write locks are used in hypercalls (such as grant-table ones), so a malicious guest could exploit the race. For instance, there is a small window where Xen can leak memory if XENMAPSPACE_grant_table is used concurrently. A malicious guest may be able to leak memory, or cause a hypervisor crash resulting in a Denial of Service (DoS). Information leak and privilege escalation cannot be excluded.","status":"published","published":"2020-04-14T12:17:49Z","modified":"2024-08-04T11:41:59.001Z","updated_at":"2026-11-02T14:35:57.67317Z"}],"euvd":[{"id":"EUVD-2020-4081","description":"An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service or possibly gain privileges because of missing memory barriers in read-write unlock paths. The read-write unlock paths don't contain a memory barrier. On Arm, this means a processor is allowed to re-order the memory access with the preceding ones. In other words, the unlock may be seen by another processor before all the memory accesses within the \"critical\" section. As a consequence, it may be possible to have a writer executing a critical section at the same time as readers or another writer. In other words, many of the assumptions (e.g., a variable cannot be modified after a check) in the critical sections are not safe anymore. The read-write locks are used in hypercalls (such as grant-table ones), so a malicious guest could exploit the race. For instance, there is a small window where Xen can leak memory if XENMAPSPACE_grant_table is used concurrently. A malicious guest may be able to leak memory, or cause a hypervisor crash resulting in a Denial of Service (DoS). Information leak and privilege escalation cannot be excluded.","status":"published","published":"2020-04-14T12:17:49Z","modified":"2024-08-04T11:41:59Z","updated_at":"2026-11-03T03:07:42.412087Z"}],"ghsa":[{"id":"GHSA-5wwp-3576-jfjc","title":"An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of...","description":"An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service or possibly gain privileges because of missing memory barriers in read-write unlock paths. The read-write unlock paths don't contain a memory barrier. On Arm, this means a processor is allowed to re-order the memory access with the preceding ones. In other words, the unlock may be seen by another processor before all the memory accesses within the \"critical\" section. As a consequence, it may be possible to have a writer executing a critical section at the same time as readers or another writer. In other words, many of the assumptions (e.g., a variable cannot be modified after a check) in the critical sections are not safe anymore. The read-write locks are used in hypercalls (such as grant-table ones), so a malicious guest could exploit the race. For instance, there is a small window where Xen can leak memory if XENMAPSPACE_grant_table is used concurrently. A malicious guest may be able to leak memory, or cause a hypervisor crash resulting in a Denial of Service (DoS). Information leak and privilege escalation cannot be excluded.","status":"published","published":"2022-05-24T17:14:11Z","modified":"2023-01-29T05:02:24Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-119","CWE-362"],"updated_at":"2026-11-02T14:45:04.348172Z"}],"nvd":[{"id":"CVE-2020-11739","description":"An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service or possibly gain privileges because of missing memory barriers in read-write unlock paths. The read-write unlock paths don't contain a memory barrier. On Arm, this means a processor is allowed to re-order the memory access with the preceding ones. In other words, the unlock may be seen by another processor before all the memory accesses within the \"critical\" section. As a consequence, it may be possible to have a writer executing a critical section at the same time as readers or another writer. In other words, many of the assumptions (e.g., a variable cannot be modified after a check) in the critical sections are not safe anymore. The read-write locks are used in hypercalls (such as grant-table ones), so a malicious guest could exploit the race. For instance, there is a small window where Xen can leak memory if XENMAPSPACE_grant_table is used concurrently. A malicious guest may be able to leak memory, or cause a hypervisor crash resulting in a Denial of Service (DoS). Information leak and privilege escalation cannot be excluded.","status":"published","published":"2020-04-14T13:15:12.703Z","modified":"2026-06-17T02:50:42.967Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.9,"vector":"AV:L/AC:M/Au:N/C:C/I:C/A:C","level":"medium","assessor":"primary"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:05:57.678762Z"}],"osv":[{"id":"ALPINE-CVE-2020-11739","description":"An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service or possibly gain privileges because of missing memory barriers in read-write unlock paths. The read-write unlock paths don't contain a memory barrier. On Arm, this means a processor is allowed to re-order the memory access with the preceding ones. In other words, the unlock may be seen by another processor before all the memory accesses within the \"critical\" section. As a consequence, it may be possible to have a writer executing a critical section at the same time as readers or another writer. In other words, many of the assumptions (e.g., a variable cannot be modified after a check) in the critical sections are not safe anymore. The read-write locks are used in hypercalls (such as grant-table ones), so a malicious guest could exploit the race. For instance, there is a small window where Xen can leak memory if XENMAPSPACE_grant_table is used concurrently. A malicious guest may be able to leak memory, or cause a hypervisor crash resulting in a Denial of Service (DoS). Information leak and privilege escalation cannot be excluded.","status":"published","published":"2020-04-14T13:15:12.703Z","modified":"2026-10-26T11:17:55.100397376Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:48.11886Z"},{"id":"CVE-2020-11739","description":"An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service or possibly gain privileges because of missing memory barriers in read-write unlock paths. The read-write unlock paths don't contain a memory barrier. On Arm, this means a processor is allowed to re-order the memory access with the preceding ones. In other words, the unlock may be seen by another processor before all the memory accesses within the \"critical\" section. As a consequence, it may be possible to have a writer executing a critical section at the same time as readers or another writer. In other words, many of the assumptions (e.g., a variable cannot be modified after a check) in the critical sections are not safe anymore. The read-write locks are used in hypercalls (such as grant-table ones), so a malicious guest could exploit the race. For instance, there is a small window where Xen can leak memory if XENMAPSPACE_grant_table is used concurrently. A malicious guest may be able to leak memory, or cause a hypervisor crash resulting in a Denial of Service (DoS). Information leak and privilege escalation cannot be excluded.","status":"published","published":"2020-04-14T13:15:12.703Z","modified":"2026-03-15T22:32:24.845206Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:14.034736Z"},{"id":"DEBIAN-CVE-2020-11739","description":"An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service or possibly gain privileges because of missing memory barriers in read-write unlock paths. The read-write unlock paths don't contain a memory barrier. On Arm, this means a processor is allowed to re-order the memory access with the preceding ones. In other words, the unlock may be seen by another processor before all the memory accesses within the \"critical\" section. As a consequence, it may be possible to have a writer executing a critical section at the same time as readers or another writer. In other words, many of the assumptions (e.g., a variable cannot be modified after a check) in the critical sections are not safe anymore. The read-write locks are used in hypercalls (such as grant-table ones), so a malicious guest could exploit the race. For instance, there is a small window where Xen can leak memory if XENMAPSPACE_grant_table is used concurrently. A malicious guest may be able to leak memory, or cause a hypervisor crash resulting in a Denial of Service (DoS). Information leak and privilege escalation cannot be excluded.","status":"published","published":"2020-04-14T13:15:12.703Z","modified":"2026-10-26T12:01:22.886973856Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.862554Z"},{"id":"UBUNTU-CVE-2020-11739","description":"An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service or possibly gain privileges because of missing memory barriers in read-write unlock paths. The read-write unlock paths don't contain a memory barrier. On Arm, this means a processor is allowed to re-order the memory access with the preceding ones. In other words, the unlock may be seen by another processor before all the memory accesses within the \"critical\" section. As a consequence, it may be possible to have a writer executing a critical section at the same time as readers or another writer. In other words, many of the assumptions (e.g., a variable cannot be modified after a check) in the critical sections are not safe anymore. The read-write locks are used in hypercalls (such as grant-table ones), so a malicious guest could exploit the race. For instance, there is a small window where Xen can leak memory if XENMAPSPACE_grant_table is used concurrently. A malicious guest may be able to leak memory, or cause a hypervisor crash resulting in a Denial of Service (DoS). Information leak and privilege escalation cannot be excluded.","status":"published","published":"2020-04-14T13:15:00Z","modified":"2026-04-22T12:27:22.218465Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:22.212782Z"},{"id":"DSA-4723-1","title":"xen - security update","status":"published","published":"2020-07-12T00:00:00Z","modified":"2026-03-09T02:10:50.585891Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"openSUSE-SU-2020:0599-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2020-11742: Bad continuation handling in GNTTABOP_copy (bsc#1169392).\n- CVE-2020-11740, CVE-2020-11741: xen: XSA-313 multiple xenoprof issues (bsc#1168140).\n- CVE-2020-11739: Missing memory barriers in read-write unlock paths (bsc#1168142).\n- CVE-2020-11743: Bad error path in GNTTABOP_map_grant (bsc#1168143).\n- arm: a CPU may speculate past the ERET instruction (bsc#1160932).\n\nNon-security issues fixed:\n\n- Xenstored Crashed during VM install (bsc#1167152)\n- DomU hang: soft lockup CPU #0 stuck under high load (bsc#1165206, bsc#1134506)\n- Update API compatibility versions, fixes issues for libvirt. (bsc#1167007, bsc#1157490)\n- aacraid blocks xen commands (bsc#1155200)\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.","status":"published","published":"2020-05-01T18:28:33Z","modified":"2026-02-04T03:58:24.043246Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:11520-1","title":"xen-4.15.1_01-1.2 on GA media","description":"These are all security issues fixed in the xen-4.15.1_01-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:22.378535Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2020:1124-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2020-11742: Bad continuation handling in GNTTABOP_copy (bsc#1169392).\n- CVE-2020-11740, CVE-2020-11741: xen: XSA-313 multiple xenoprof issues (bsc#1168140).\n- CVE-2020-11739: Missing memory barriers in read-write unlock paths (bsc#1168142).\n- CVE-2020-11743: Bad error path in GNTTABOP_map_grant (bsc#1168143).\n- arm: a CPU may speculate past the ERET instruction (bsc#1160932).\n\nNon-security issues fixed:\n\n- Xenstored Crashed during VM install (bsc#1167152)\n- DomU hang: soft lockup CPU #0 stuck under high load (bsc#1165206, bsc#1134506)\n- Update API compatibility versions, fixes issues for libvirt. (bsc#1167007, bsc#1157490)\n- aacraid blocks xen commands (bsc#1155200)\n","status":"published","published":"2020-04-28T05:49:29Z","modified":"2026-02-04T04:08:43.282183Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:1138-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2020-11742: Bad continuation handling in GNTTABOP_copy (bsc#1169392).\n- CVE-2020-11740, CVE-2020-11741: xen: XSA-313 multiple xenoprof issues (bsc#1168140).\n- CVE-2020-11739: Missing memory barriers in read-write unlock paths (bsc#1168142).\n- CVE-2020-11743: Bad error path in GNTTABOP_map_grant (bsc#1168143).\n- CVE-2020-7211: Fixed potential directory traversal using relative paths via\n  tftp server on Windows host (bsc#1161181).\n- arm: a CPU may speculate past the ERET instruction (bsc#1160932).\n\nNon-security issues fixed:\n\n- Xenstored Crashed during VM install (bsc#1167152)\n- DomU hang: soft lockup CPU #0 stuck under high load (bsc#1165206, bsc#1134506)\n- Update API compatibility versions, fixes issues for libvirt. (bsc#1167007, bsc#1157490)\n- aacraid blocks xen commands (bsc#1155200)\n","status":"published","published":"2020-04-29T10:53:10Z","modified":"2025-05-02T04:09:38.002253Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:1139-1","title":"Security update for xen","description":"This update for xen to version 4.12.2 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2020-11742: Bad continuation handling in GNTTABOP_copy (bsc#1169392).\n- CVE-2020-11740, CVE-2020-11741: xen: XSA-313 multiple xenoprof issues (bsc#1168140).\n- CVE-2020-11739: Missing memory barriers in read-write unlock paths (bsc#1168142).\n- CVE-2020-11743: Bad error path in GNTTABOP_map_grant (bsc#1168143).\n- CVE-2020-7211: Fixed potential directory traversal using relative paths via \n  tftp server on Windows host (bsc#1161181).\n- arm: a CPU may speculate past the ERET instruction (bsc#1160932).\n\nNon-security issues fixed:\n\n- Xenstored Crashed during VM install (bsc#1167152)\n- DomU hang: soft lockup CPU #0 stuck under high load (bsc#1165206, bsc#1134506)\n- Update API compatibility versions, fixes issues for libvirt. (bsc#1167007, bsc#1157490)\n- aacraid blocks xen commands (bsc#1155200)\n- Problems Booting Fedora31 VM on sles15 sp1 Xen Dom0 (bsc#1162040).\n","status":"published","published":"2020-04-29T10:53:27Z","modified":"2026-02-04T03:26:20.279699Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:1630-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2020-0543: Fixed a side channel attack against special registers which could have resulted in leaking of read values to cores other than the one which called it.\n  This attack is known as Special Register Buffer Data Sampling (SRBDS) or 'CrossTalk' (bsc#1172205).\n- CVE-2020-11742: Bad continuation handling in GNTTABOP_copy (bsc#1169392).\n- CVE-2020-11740, CVE-2020-11741: xen: XSA-313 multiple xenoprof issues (bsc#1168140).\n- CVE-2020-11739: Missing memory barriers in read-write unlock paths (bsc#1168142).\n- CVE-2019-19583: Fixed improper checks which could have allowed HVM/PVH guest userspace code to crash the guest, leading to a guest denial of service (bsc#1158004 XSA-308).\n- CVE-2019-19581: Fixed a potential out of bounds on 32-bit Arm (bsc#1158003 XSA-307).\n- CVE-2019-19580: Fixed a privilege escalation where a malicious PV guest administrator could have been able to escalate their privilege to that of the host (bsc#1158006 XSA-310).\n- CVE-2019-19579: Fixed a privilege escalation where an untrusted domain with access to a physical device can DMA into host memory (bsc#1157888 XSA-306).\n- CVE-2019-19578: Fixed an issue where a malicious or buggy PV guest could have caused hypervisor crash resulting in denial of service affecting the entire host (bsc#1158005 XSA-309).\n- CVE-2019-19577: Fixed an issue where a malicious guest administrator could have caused Xen to access data structures while they are being modified leading to a crash (bsc#1158007 XSA-311). \n- Xenstored Crashed during VM install (bsc#1167152)\n","status":"published","published":"2020-06-16T15:01:26Z","modified":"2026-02-04T04:04:00.251066Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:1634-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2020-0543: Fixed a side channel attack against special registers which could have resulted in leaking of read values to cores other than the one which called it.\n  This attack is known as Special Register Buffer Data Sampling (SRBDS) or 'CrossTalk' (bsc#1172205).\n- CVE-2020-11742: Bad continuation handling in GNTTABOP_copy (bsc#1169392).\n- CVE-2020-11740, CVE-2020-11741: xen: XSA-313 multiple xenoprof issues (bsc#1168140).\n- CVE-2020-11739: Missing memory barriers in read-write unlock paths (bsc#1168142).\n- CVE-2020-11743: Bad error path in GNTTABOP_map_grant (bsc#1168143).\n- Xenstored Crashed during VM install (bsc#1167152)\n","status":"published","published":"2020-06-17T08:35:43Z","modified":"2026-02-04T02:58:55.885617Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:2234-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- bsc#1174543 - secure boot related fixes\n- bsc#1163019 - CVE-2020-8608: Potential OOB access due to unsafe snprintf() usages\n- bsc#1169392 - CVE-2020-11742: Bad continuation handling in GNTTABOP_copy\n- bsc#1168140 - CVE-2020-11740, CVE-2020-11741: Multiple xenoprof issues\n- bsc#1168142 - CVE-2020-11739: Missing memory barriers in read-write unlock paths\n","status":"published","published":"2020-08-13T09:33:35Z","modified":"2026-02-04T02:53:40.377801Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"USN-5617-1","title":"xen vulnerabilities","description":"It was discovered that memory contents previously stored in\nmicroarchitectural special registers after RDRAND, RDSEED, and SGX EGETKEY\nread operations on Intel client and Xeon E3 processors may be briefly\nexposed to processes on the same or different processor cores. A local\nattacker could use this to expose sensitive information. (CVE-2020-0543)\n\nJulien Grall discovered that Xen incorrectly handled memory barriers on\nARM-based systems. An attacker could possibly use this issue to cause a\ndenial of service, obtain sensitive information or escalate privileges.\n(CVE-2020-11739)\n\nIlja Van Sprundel discovered that Xen incorrectly handled profiling of\nguests. An unprivileged attacker could use this issue to obtain sensitive\ninformation from other guests, cause a denial of service or possibly gain\nprivileges. (CVE-2020-11740, CVE-2020-11741)\n\nIt was discovered that Xen incorrectly handled grant tables. A malicious\nguest could possibly use this issue to cause a denial of service.\n(CVE-2020-11742, CVE-2020-11743)\n\nJan Beulich discovered that Xen incorrectly handled certain code paths. An\nattacker could possibly use this issue to cause a denial of service.\n(CVE-2020-15563)\n\nJulien Grall discovered that Xen incorrectly verified memory addresses\nprovided by the guest on ARM-based systems. A malicious guest administrator\ncould possibly use this issue to cause a denial of service. (CVE-2020-15564)\n\nRoger Pau Monné discovered that Xen incorrectly handled caching on x86 Intel\nsystems. An attacker could possibly use this issue to cause a denial of\nservice. (CVE-2020-15565)\n\nIt was discovered that Xen incorrectly handled error in event-channel port\nallocation. A malicious guest could possibly use this issue to cause a\ndenial of service. (CVE-2020-15566)\n\nJan Beulich discovered that Xen incorrectly handled certain EPT (Extended\nPage Tables).  An attacker could possibly use this issue to cause a denial\nof service, data corruption or privilege escalation. (CVE-2020-15567)\n\nAndrew Cooper discovered that Xen incorrectly handled PCI passthrough.\nAn attacker could possibly use this issue to cause a denial of service.\n(CVE-2020-25595)\n\nAndrew Cooper discovered that Xen incorrectly sanitized path injections.\nAn attacker could possibly use this issue to cause a denial of service.\n(CVE-2020-25596)\n\nJan Beulich discovered that Xen incorrectly handled validation of event\nchannels. An attacker could possibly use this issue to cause a denial\nof service. (CVE-2020-25597)\n\nJulien Grall and Jan Beulich discovered that Xen incorrectly handled\nresetting event channels. An attacker could possibly use this issue to\ncause a denial of service or obtain sensitive information. (CVE-2020-25599)\n\nJulien Grall discovered that Xen incorrectly handled event channels\nmemory allocation on 32-bits domains. An attacker could possibly use this\nissue to cause a denial of service. (CVE-2020-25600)\n\nJan Beulich discovered that Xen incorrectly handled resetting or cleaning\nup event channels. An attacker could possibly use this issue to cause a\ndenial of service. (CVE-2020-25601)\n\nAndrew Cooper discovered that Xen incorrectly handled certain Intel\nspecific MSR (Model Specific Registers). An attacker could possibly use\nthis issue to cause a denial of service. (CVE-2020-25602)\n\nJulien Grall discovered that Xen incorrectly handled accessing/allocating\nevent channels. An attacker could possibly use this issue to cause a\ndenial of service, obtain sensitive information of privilege escalation.\n(CVE-2020-25603)\n\nIgor Druzhinin discovered that Xen incorrectly handled locks. An attacker\ncould possibly use this issue to cause a denial of service. (CVE-2020-25604)\n","status":"published","published":"2022-09-19T16:56:10Z","modified":"2026-04-27T16:32:22.079286043Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}