{"id":"CVE-2020-25598","aliases":["ALPINE-CVE-2020-25598","EUVD-2020-18277","GHSA-6vvr-9x9v-68j4","SUSE-SU-2020:2788-1","SUSE-SU-2020:2790-1","SUSE-SU-2020:2791-1","openSUSE-SU-2020:1608-1","openSUSE-SU-2024:11520-1"],"status":"published","title":"An issue was discovered in Xen 4.14.x. There is a missing unlock in the XENMEM_acquire_resource...","description":"An issue was discovered in Xen 4.14.x. There is a missing unlock in the XENMEM_acquire_resource error path. The RCU (Read, Copy, Update) mechanism is a synchronisation primitive. A buggy error path in the XENMEM_acquire_resource exits without releasing an RCU reference, which is conceptually similar to forgetting to unlock a spinlock. A buggy or malicious HVM stubdomain can cause an RCU reference to be leaked. This causes subsequent administration operations, (e.g., CPU offline) to livelock, resulting in a host Denial of Service. The buggy codepath has been present since Xen 4.12. Xen 4.14 and later are vulnerable to the DoS. The side effects are believed to be benign on Xen 4.12 and 4.13, but patches are provided nevertheless. The vulnerability can generally only be exploited by x86 HVM VMs, as these are generally the only type of VM that have a Qemu stubdomain. x86 PV and PVH domains, as well as ARM VMs, typically don't use a stubdomain. Only VMs using HVM stubdomains can exploit the vulnerability. VMs using PV stubdomains, or with emulators running in dom0, cannot exploit the vulnerability.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00416,"percentile":0.36368,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-670"],"published":"2020-09-23T21:07:44Z","modified":"2026-10-26T11:17:55Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"xen","fixed_in":["4.12.3-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"xen","fixed_in":["4.13.1-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"xen","fixed_in":["4.13.1-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"xen","fixed_in":["4.14.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"xen","fixed_in":["4.14.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"xen","fixed_in":["4.14.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"xen","fixed_in":["4.14.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"xen","fixed_in":["4.14.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"xen","fixed_in":["4.14.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"xen","fixed_in":["4.14.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"xen","fixed_in":["4.14.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"xen","fixed_in":["4.14.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"xen","fixed_in":["4.14.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"xen","fixed_in":["4.14.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"xen","fixed_in":["4.14.0-r1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.12.0"},{"fixed":"4.12.3-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.12.0"},{"fixed":"4.13.1-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.12.0"},{"fixed":"4.13.1-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.12.0"},{"fixed":"4.14.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.12.0"},{"fixed":"4.14.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.12.0"},{"fixed":"4.14.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.12.0"},{"fixed":"4.14.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.12.0"},{"fixed":"4.14.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.12.0"},{"fixed":"4.14.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.12.0"},{"fixed":"4.14.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.12.0"},{"fixed":"4.14.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.12.0"},{"fixed":"4.14.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.12.0"},{"fixed":"4.14.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.12.0"},{"fixed":"4.14.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.12.0"},{"fixed":"4.14.0-r1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.3_08-3.24.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.3_08-3.24.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.3_08-3.24.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.3_08-3.28.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.3_08-3.28.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.1_08-3.10.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP2","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.1_08-3.10.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.1_08-lp152.2.9.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.1_01-1.2"}]}],"bundled":93}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"opensuse","product":"leap"},{"vendor":"xen","product":"xen"}],"references":[{"url":"https://xenbits.xen.org/xsa/advisory-334.html","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4JRXMKEMQRQYWYEPHVBIWUEAVQ3LU4FN/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DA633Y3G5KX7MKRN4PFEGM3IVTJMBEOM/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00008.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RJZERRBJN6E6STDCHT4JHP4MI6TKBCJE/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202011-06","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-25598"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4JRXMKEMQRQYWYEPHVBIWUEAVQ3LU4FN/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DA633Y3G5KX7MKRN4PFEGM3IVTJMBEOM/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJZERRBJN6E6STDCHT4JHP4MI6TKBCJE/"},{"url":"https://github.com/advisories/GHSA-6vvr-9x9v-68j4"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-25598","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202788-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1027519","tags":["report"]},{"url":"https://bugzilla.suse.com/1175534","tags":["report"]},{"url":"https://bugzilla.suse.com/1176339","tags":["report"]},{"url":"https://bugzilla.suse.com/1176341","tags":["report"]},{"url":"https://bugzilla.suse.com/1176343","tags":["report"]},{"url":"https://bugzilla.suse.com/1176344","tags":["report"]},{"url":"https://bugzilla.suse.com/1176345","tags":["report"]},{"url":"https://bugzilla.suse.com/1176346","tags":["report"]},{"url":"https://bugzilla.suse.com/1176347","tags":["report"]},{"url":"https://bugzilla.suse.com/1176348","tags":["report"]},{"url":"https://bugzilla.suse.com/1176349","tags":["report"]},{"url":"https://bugzilla.suse.com/1176350","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14364","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25596","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25598","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25599","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25604","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202790-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202791-1/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/CHO5L6PB6IYMBMXLFOWKZSK5RTFI66UU/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2007-1320","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-1366","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10025","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8667","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8910","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9932","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12137","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8309","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9330","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10472","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12892","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12893","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15470","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19966","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19967","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3639","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3646","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7540","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7541","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-0543","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11742","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15565","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15567","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27670","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27671","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27672","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-28368","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29480","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29483","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29484","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29567","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29570","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28687","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-25598","description":"An issue was discovered in Xen 4.14.x. There is a missing unlock in the XENMEM_acquire_resource error path. The RCU (Read, Copy, Update) mechanism is a synchronisation primitive. A buggy error path in the XENMEM_acquire_resource exits without releasing an RCU reference, which is conceptually similar to forgetting to unlock a spinlock. A buggy or malicious HVM stubdomain can cause an RCU reference to be leaked. This causes subsequent administration operations, (e.g., CPU offline) to livelock, resulting in a host Denial of Service. The buggy codepath has been present since Xen 4.12. Xen 4.14 and later are vulnerable to the DoS. The side effects are believed to be benign on Xen 4.12 and 4.13, but patches are provided nevertheless. The vulnerability can generally only be exploited by x86 HVM VMs, as these are generally the only type of VM that have a Qemu stubdomain. x86 PV and PVH domains, as well as ARM VMs, typically don't use a stubdomain. Only VMs using HVM stubdomains can exploit the vulnerability. VMs using PV stubdomains, or with emulators running in dom0, cannot exploit the vulnerability.","status":"published","published":"2020-09-23T21:07:44Z","modified":"2024-08-04T15:33:05.766Z","updated_at":"2026-11-02T14:35:48.52216Z"}],"euvd":[{"id":"EUVD-2020-18277","description":"An issue was discovered in Xen 4.14.x. There is a missing unlock in the XENMEM_acquire_resource error path. The RCU (Read, Copy, Update) mechanism is a synchronisation primitive. A buggy error path in the XENMEM_acquire_resource exits without releasing an RCU reference, which is conceptually similar to forgetting to unlock a spinlock. A buggy or malicious HVM stubdomain can cause an RCU reference to be leaked. This causes subsequent administration operations, (e.g., CPU offline) to livelock, resulting in a host Denial of Service. The buggy codepath has been present since Xen 4.12. Xen 4.14 and later are vulnerable to the DoS. The side effects are believed to be benign on Xen 4.12 and 4.13, but patches are provided nevertheless. The vulnerability can generally only be exploited by x86 HVM VMs, as these are generally the only type of VM that have a Qemu stubdomain. x86 PV and PVH domains, as well as ARM VMs, typically don't use a stubdomain. Only VMs using HVM stubdomains can exploit the vulnerability. VMs using PV stubdomains, or with emulators running in dom0, cannot exploit the vulnerability.","status":"published","published":"2020-09-23T21:07:44Z","modified":"2024-08-04T15:33:05Z","updated_at":"2026-11-03T03:07:17.317062Z"}],"ghsa":[{"id":"GHSA-6vvr-9x9v-68j4","title":"An issue was discovered in Xen 4.14.x. There is a missing unlock in the XENMEM_acquire_resource...","description":"An issue was discovered in Xen 4.14.x. There is a missing unlock in the XENMEM_acquire_resource error path. The RCU (Read, Copy, Update) mechanism is a synchronisation primitive. A buggy error path in the XENMEM_acquire_resource exits without releasing an RCU reference, which is conceptually similar to forgetting to unlock a spinlock. A buggy or malicious HVM stubdomain can cause an RCU reference to be leaked. This causes subsequent administration operations, (e.g., CPU offline) to livelock, resulting in a host Denial of Service. The buggy codepath has been present since Xen 4.12. Xen 4.14 and later are vulnerable to the DoS. The side effects are believed to be benign on Xen 4.12 and 4.13, but patches are provided nevertheless. The vulnerability can generally only be exploited by x86 HVM VMs, as these are generally the only type of VM that have a Qemu stubdomain. x86 PV and PVH domains, as well as ARM VMs, typically don't use a stubdomain. Only VMs using HVM stubdomains can exploit the vulnerability. VMs using PV stubdomains, or with emulators running in dom0, cannot exploit the vulnerability.","status":"published","published":"2022-05-24T17:29:24Z","modified":"2023-01-28T05:02:34Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-670"],"updated_at":"2026-11-02T14:43:48.368168Z"}],"nvd":[{"id":"CVE-2020-25598","description":"An issue was discovered in Xen 4.14.x. There is a missing unlock in the XENMEM_acquire_resource error path. The RCU (Read, Copy, Update) mechanism is a synchronisation primitive. A buggy error path in the XENMEM_acquire_resource exits without releasing an RCU reference, which is conceptually similar to forgetting to unlock a spinlock. A buggy or malicious HVM stubdomain can cause an RCU reference to be leaked. This causes subsequent administration operations, (e.g., CPU offline) to livelock, resulting in a host Denial of Service. The buggy codepath has been present since Xen 4.12. Xen 4.14 and later are vulnerable to the DoS. The side effects are believed to be benign on Xen 4.12 and 4.13, but patches are provided nevertheless. The vulnerability can generally only be exploited by x86 HVM VMs, as these are generally the only type of VM that have a Qemu stubdomain. x86 PV and PVH domains, as well as ARM VMs, typically don't use a stubdomain. Only VMs using HVM stubdomains can exploit the vulnerability. VMs using PV stubdomains, or with emulators running in dom0, cannot exploit the vulnerability.","status":"published","published":"2020-09-23T22:15:13.367Z","modified":"2026-06-17T03:06:57.12Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-670"],"updated_at":"2026-11-02T14:06:15.83396Z"}],"osv":[{"id":"ALPINE-CVE-2020-25598","description":"An issue was discovered in Xen 4.14.x. There is a missing unlock in the XENMEM_acquire_resource error path. The RCU (Read, Copy, Update) mechanism is a synchronisation primitive. A buggy error path in the XENMEM_acquire_resource exits without releasing an RCU reference, which is conceptually similar to forgetting to unlock a spinlock. A buggy or malicious HVM stubdomain can cause an RCU reference to be leaked. This causes subsequent administration operations, (e.g., CPU offline) to livelock, resulting in a host Denial of Service. The buggy codepath has been present since Xen 4.12. Xen 4.14 and later are vulnerable to the DoS. The side effects are believed to be benign on Xen 4.12 and 4.13, but patches are provided nevertheless. The vulnerability can generally only be exploited by x86 HVM VMs, as these are generally the only type of VM that have a Qemu stubdomain. x86 PV and PVH domains, as well as ARM VMs, typically don't use a stubdomain. Only VMs using HVM stubdomains can exploit the vulnerability. VMs using PV stubdomains, or with emulators running in dom0, cannot exploit the vulnerability.","status":"published","published":"2020-09-23T22:15:13.367Z","modified":"2026-10-26T11:17:55.153121185Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:48.11886Z"},{"id":"CVE-2020-25598","description":"An issue was discovered in Xen 4.14.x. There is a missing unlock in the XENMEM_acquire_resource error path. The RCU (Read, Copy, Update) mechanism is a synchronisation primitive. A buggy error path in the XENMEM_acquire_resource exits without releasing an RCU reference, which is conceptually similar to forgetting to unlock a spinlock. A buggy or malicious HVM stubdomain can cause an RCU reference to be leaked. This causes subsequent administration operations, (e.g., CPU offline) to livelock, resulting in a host Denial of Service. The buggy codepath has been present since Xen 4.12. Xen 4.14 and later are vulnerable to the DoS. The side effects are believed to be benign on Xen 4.12 and 4.13, but patches are provided nevertheless. The vulnerability can generally only be exploited by x86 HVM VMs, as these are generally the only type of VM that have a Qemu stubdomain. x86 PV and PVH domains, as well as ARM VMs, typically don't use a stubdomain. Only VMs using HVM stubdomains can exploit the vulnerability. VMs using PV stubdomains, or with emulators running in dom0, cannot exploit the vulnerability.","status":"published","published":"2020-09-23T22:15:13.367Z","modified":"2026-03-15T22:35:06.905446Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:15.879068Z"},{"id":"openSUSE-SU-2020:1608-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2020-25602: Fixed an issue where there was a crash when\n  handling guest access to MSR_MISC_ENABLE was thrown (bsc#1176339,XSA-333)\n- CVE-2020-25598: Added a missing unlock in XENMEM_acquire_resource error path\n  (bsc#1176341,XSA-334)\n- CVE-2020-25604: Fixed a race condition when migrating timers between x86 \n  HVM vCPU-s (bsc#1176343,XSA-336)\n- CVE-2020-25595: Fixed an issue where PCI passthrough code was reading back hardware registers (bsc#1176344,XSA-337)\n- CVE-2020-25597: Fixed an issue where a valid event channels may not turn invalid (bsc#1176346,XSA-338)\n- CVE-2020-25596: Fixed a potential denial of service in x86 pv guest kernel via SYSENTER (bsc#1176345,XSA-339)\n- CVE-2020-25603: Fixed an issue due to  missing barriers when accessing/allocating an event channel (bsc#1176347,XSA-340)\n- CVE-2020-25600: Fixed out of bounds event channels available to 32-bit x86 domains (bsc#1176348,XSA-342)\n- CVE-2020-25599: Fixed race conditions with evtchn_reset() (bsc#1176349,XSA-343)\n- CVE-2020-25601: Fixed an issue due to lack of preemption in evtchn_reset() / evtchn_destroy() (bsc#1176350,XSA-344)\n- Various other fixes (bsc#1027519)\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2020-10-04T04:23:35Z","modified":"2026-02-04T03:56:06.537967Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2024:11520-1","title":"xen-4.15.1_01-1.2 on GA media","description":"These are all security issues fixed in the xen-4.15.1_01-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:22.378535Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2020:2788-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2020-25602: Fixed an issue where there was a crash when\n  handling guest access to MSR_MISC_ENABLE was thrown (bsc#1176339,XSA-333)\n- CVE-2020-25598: Added a missing unlock in XENMEM_acquire_resource error path\n  (bsc#1176341,XSA-334)\n- CVE-2020-25604: Fixed a race condition when migrating timers between x86 \n  HVM vCPU-s (bsc#1176343,XSA-336)\n- CVE-2020-25595: Fixed an issue where PCI passthrough code was reading back hardware registers (bsc#1176344,XSA-337)\n- CVE-2020-25597: Fixed an issue where a valid event channels may not turn invalid (bsc#1176346,XSA-338)\n- CVE-2020-25596: Fixed a potential denial of service in x86 pv guest kernel via SYSENTER (bsc#1176345,XSA-339)\n- CVE-2020-25603: Fixed an issue due to  missing barriers when accessing/allocating an event channel (bsc#1176347,XSA-340)\n- CVE-2020-25600: Fixed out of bounds event channels available to 32-bit x86 domains (bsc#1176348,XSA-342)\n- CVE-2020-25599: Fixed race conditions with evtchn_reset() (bsc#1176349,XSA-343)\n- CVE-2020-25601: Fixed an issue due to lack of preemption in evtchn_reset() / evtchn_destroy() (bsc#1176350,XSA-344)\t  \n- CVE-2020-14364: Fixed an out-of-bounds read/write access while processing usb packets (bsc#1175534).\n- Various bug fixes (bsc#1027519)\n","status":"published","published":"2020-09-29T12:13:04Z","modified":"2026-02-04T02:13:28.886469Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:2790-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2020-25602: Fixed an issue where there was a crash when\n  handling guest access to MSR_MISC_ENABLE was thrown (bsc#1176339,XSA-333)\n- CVE-2020-25598: Added a missing unlock in XENMEM_acquire_resource error path\n  (bsc#1176341,XSA-334)\n- CVE-2020-25604: Fixed a race condition when migrating timers between x86 \n  HVM vCPU-s (bsc#1176343,XSA-336)\n- CVE-2020-25595: Fixed an issue where PCI passthrough code was reading back hardware registers (bsc#1176344,XSA-337)\n- CVE-2020-25597: Fixed an issue where a valid event channels may not turn invalid (bsc#1176346,XSA-338)\n- CVE-2020-25596: Fixed a potential denial of service in x86 pv guest kernel via SYSENTER (bsc#1176345,XSA-339)\n- CVE-2020-25603: Fixed an issue due to  missing barriers when accessing/allocating an event channel (bsc#1176347,XSA-340)\n- CVE-2020-25600: Fixed out of bounds event channels available to 32-bit x86 domains (bsc#1176348,XSA-342)\n- CVE-2020-25599: Fixed race conditions with evtchn_reset() (bsc#1176349,XSA-343)\n- CVE-2020-25601: Fixed an issue due to lack of preemption in evtchn_reset() / evtchn_destroy() (bsc#1176350,XSA-344)\t  \n\n- Various bug fixes (bsc#1027519)\n","status":"published","published":"2020-09-29T12:13:34Z","modified":"2025-05-02T04:10:04.356974Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:2791-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2020-25602: Fixed an issue where there was a crash when\n  handling guest access to MSR_MISC_ENABLE was thrown (bsc#1176339,XSA-333)\n- CVE-2020-25598: Added a missing unlock in XENMEM_acquire_resource error path\n  (bsc#1176341,XSA-334)\n- CVE-2020-25604: Fixed a race condition when migrating timers between x86 \n  HVM vCPU-s (bsc#1176343,XSA-336)\n- CVE-2020-25595: Fixed an issue where PCI passthrough code was reading back hardware registers (bsc#1176344,XSA-337)\n- CVE-2020-25597: Fixed an issue where a valid event channels may not turn invalid (bsc#1176346,XSA-338)\n- CVE-2020-25596: Fixed a potential denial of service in x86 pv guest kernel via SYSENTER (bsc#1176345,XSA-339)\n- CVE-2020-25603: Fixed an issue due to  missing barriers when accessing/allocating an event channel (bsc#1176347,XSA-340)\n- CVE-2020-25600: Fixed out of bounds event channels available to 32-bit x86 domains (bsc#1176348,XSA-342)\n- CVE-2020-25599: Fixed race conditions with evtchn_reset() (bsc#1176349,XSA-343)\n- CVE-2020-25601: Fixed an issue due to lack of preemption in evtchn_reset() / evtchn_destroy() (bsc#1176350,XSA-344)\n- Various other fixes (bsc#1027519)\n","status":"published","published":"2020-09-29T12:13:49Z","modified":"2026-02-04T04:29:23.874597Z","updated_at":"2026-11-02T15:53:48.11786Z"}]}}