{"id":"CVE-2020-25603","aliases":["ALPINE-CVE-2020-25603","DEBIAN-CVE-2020-25603","DSA-4769-1","EUVD-2020-18282","GHSA-27c2-9cc9-22v7","SUSE-SU-2020:14521-1","SUSE-SU-2020:2786-1","SUSE-SU-2020:2787-1","SUSE-SU-2020:2788-1","SUSE-SU-2020:2789-1","SUSE-SU-2020:2790-1","SUSE-SU-2020:2791-1","SUSE-SU-2020:2822-1","UBUNTU-CVE-2020-25603","USN-5617-1","openSUSE-SU-2020:1608-1","openSUSE-SU-2024:11520-1"],"status":"published","title":"An issue was discovered in Xen through 4.14.x. There are missing memory barriers when accessing...","description":"An issue was discovered in Xen through 4.14.x. There are missing memory barriers when accessing/allocating an event channel. Event channels control structures can be accessed lockless as long as the port is considered to be valid. Such a sequence is missing an appropriate memory barrier (e.g., smp_*mb()) to prevent both the compiler and CPU from re-ordering access. A malicious guest may be able to cause a hypervisor crash resulting in a Denial of Service (DoS). Information leak and privilege escalation cannot be excluded. Systems running all versions of Xen are affected. Whether a system is vulnerable will depend on the CPU and compiler used to build Xen. For all systems, the presence and the scope of the vulnerability depend on the precise re-ordering performed by the compiler used to build Xen. We have not been able to survey compilers; consequently we cannot say which compiler(s) might produce vulnerable code (with which code generation options). GCC documentation clearly suggests that re-ordering is possible. Arm systems will also be vulnerable if the CPU is able to re-order memory access. Please consult your CPU vendor. x86 systems are only vulnerable if a compiler performs re-ordering.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00415,"percentile":0.36255,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-401","CWE-670"],"published":"2020-09-23T21:34:56Z","modified":"2026-10-26T12:02:40Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"xen","fixed_in":["4.12.3-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"xen","fixed_in":["4.13.1-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"xen","fixed_in":["4.13.1-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"xen","fixed_in":["4.14.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"xen","fixed_in":["4.14.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"xen","fixed_in":["4.14.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"xen","fixed_in":["4.14.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"xen","fixed_in":["4.14.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"xen","fixed_in":["4.14.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"xen","fixed_in":["4.14.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"xen","fixed_in":["4.14.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"xen","fixed_in":["4.14.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"xen","fixed_in":["4.14.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"xen","fixed_in":["4.14.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"xen","fixed_in":["4.14.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"xen","fixed_in":["4.11.4-r2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"xen","fixed_in":["4.14.0+80-gd101b417b7-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xen","fixed_in":["4.14.0+80-gd101b417b7-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xen","fixed_in":["4.14.0+80-gd101b417b7-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"xen","fixed_in":["4.11.3+24-g14b62ab3e5-1ubuntu2.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.3-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.1-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.1-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11.4-r2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.0+80-gd101b417b7-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.0+80-gd101b417b7-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.0+80-gd101b417b7-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11.4+37-g3263f257ca-1"}]}],"versions":["4.11.1+92-g6c33308a8d-2","4.11.3+24-g14b62ab3e5-1","4.11.3+24-g14b62ab3e5-1~deb10u1","4.11.4+24-gddaaccbbab-1","4.11.4+24-gddaaccbbab-1~deb10u1","4.11.4-1"],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.4_44-61.55.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11.4_08-2.36.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11.4_08-2.36.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11.4_08-2.36.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11.4_08-2.36.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.4_12-3.74.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.4_12-3.74.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.4_12-3.74.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.4_12-3.74.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.4_12-3.74.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.4_12-3.74.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.4_12-3.74.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.3_08-3.24.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.3_08-3.24.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.3_08-3.24.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.4_16-3.41.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.4_16-3.41.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.4_16-3.41.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.3_08-3.28.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP1","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.3_08-3.28.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.1_08-3.10.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP2","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.1_08-3.10.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.6_10-43.67.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.6_10-43.67.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.6_10-43.67.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.6_10-43.67.1"}]}],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.5.1-0ubuntu1","4.5.1-0ubuntu2","4.6.0-1ubuntu1","4.6.0-1ubuntu2","4.6.0-1ubuntu4","4.6.0-1ubuntu4.1","4.6.0-1ubuntu4.2","4.6.0-1ubuntu4.3","4.6.5-0ubuntu1","4.6.5-0ubuntu1.1","4.6.5-0ubuntu1.2","4.6.5-0ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.9.0-0ubuntu3","4.9.0-0ubuntu4","4.9.2-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11.3+24-g14b62ab3e5-1ubuntu2.3"}]}],"versions":["4.9.2-0ubuntu2","4.9.2-0ubuntu6","4.9.2-0ubuntu7","4.11.3+24-g14b62ab3e5-1ubuntu1","4.11.3+24-g14b62ab3e5-1ubuntu2","4.11.3+24-g14b62ab3e5-1ubuntu2.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11.3+24-g14b62ab3e5-1ubuntu2.3"}]}],"versions":["4.9.2-0ubuntu2","4.9.2-0ubuntu6","4.9.2-0ubuntu7","4.11.3+24-g14b62ab3e5-1ubuntu1","4.11.3+24-g14b62ab3e5-1ubuntu2","4.11.3+24-g14b62ab3e5-1ubuntu2.2"],"bundled":20},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.1_08-lp152.2.9.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.1_01-1.2"}]}],"bundled":93}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"opensuse","product":"leap"},{"vendor":"xen","product":"xen"}],"references":[{"url":"https://xenbits.xen.org/xsa/advisory-340.html","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4JRXMKEMQRQYWYEPHVBIWUEAVQ3LU4FN/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DA633Y3G5KX7MKRN4PFEGM3IVTJMBEOM/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://www.debian.org/security/2020/dsa-4769","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00008.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RJZERRBJN6E6STDCHT4JHP4MI6TKBCJE/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202011-06","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-25603"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4JRXMKEMQRQYWYEPHVBIWUEAVQ3LU4FN/","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DA633Y3G5KX7MKRN4PFEGM3IVTJMBEOM/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJZERRBJN6E6STDCHT4JHP4MI6TKBCJE/"},{"url":"https://github.com/advisories/GHSA-27c2-9cc9-22v7"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-25603","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-25603","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-202014521-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1172205","tags":["report"]},{"url":"https://bugzilla.suse.com/1173378","tags":["report"]},{"url":"https://bugzilla.suse.com/1173380","tags":["report"]},{"url":"https://bugzilla.suse.com/1175534","tags":["report"]},{"url":"https://bugzilla.suse.com/1176343","tags":["report"]},{"url":"https://bugzilla.suse.com/1176344","tags":["report"]},{"url":"https://bugzilla.suse.com/1176345","tags":["report"]},{"url":"https://bugzilla.suse.com/1176346","tags":["report"]},{"url":"https://bugzilla.suse.com/1176347","tags":["report"]},{"url":"https://bugzilla.suse.com/1176348","tags":["report"]},{"url":"https://bugzilla.suse.com/1176350","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-0543","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14364","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15565","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15567","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25596","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25600","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25603","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25604","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202786-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1027519","tags":["report"]},{"url":"https://bugzilla.suse.com/1176339","tags":["report"]},{"url":"https://bugzilla.suse.com/1176349","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25599","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25602","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202787-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202788-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1176341","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25598","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202789-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202790-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202791-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202822-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-25603","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5617-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-25603","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-0543","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-11739","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-11740","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-11741","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-11742","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-11743","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-15563","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-15564","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-15565","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-15566","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-15567","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-25595","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-25596","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-25597","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-25599","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-25600","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-25601","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-25602","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-25604","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/CHO5L6PB6IYMBMXLFOWKZSK5RTFI66UU/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2007-1320","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-1366","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10025","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8667","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8910","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9932","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12137","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8309","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9330","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10472","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12892","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12893","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15470","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19966","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19967","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3639","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3646","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7540","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7541","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11742","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27670","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27671","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27672","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-28368","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29480","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29483","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29484","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29567","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29570","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28687","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-25603","description":"An issue was discovered in Xen through 4.14.x. There are missing memory barriers when accessing/allocating an event channel. Event channels control structures can be accessed lockless as long as the port is considered to be valid. Such a sequence is missing an appropriate memory barrier (e.g., smp_*mb()) to prevent both the compiler and CPU from re-ordering access. A malicious guest may be able to cause a hypervisor crash resulting in a Denial of Service (DoS). Information leak and privilege escalation cannot be excluded. Systems running all versions of Xen are affected. Whether a system is vulnerable will depend on the CPU and compiler used to build Xen. For all systems, the presence and the scope of the vulnerability depend on the precise re-ordering performed by the compiler used to build Xen. We have not been able to survey compilers; consequently we cannot say which compiler(s) might produce vulnerable code (with which code generation options). GCC documentation clearly suggests that re-ordering is possible. Arm systems will also be vulnerable if the CPU is able to re-order memory access. Please consult your CPU vendor. x86 systems are only vulnerable if a compiler performs re-ordering.","status":"published","published":"2020-09-23T21:34:56Z","modified":"2024-08-04T15:33:05.752Z","updated_at":"2026-11-02T14:35:48.52216Z"}],"euvd":[{"id":"EUVD-2020-18282","description":"An issue was discovered in Xen through 4.14.x. There are missing memory barriers when accessing/allocating an event channel. Event channels control structures can be accessed lockless as long as the port is considered to be valid. Such a sequence is missing an appropriate memory barrier (e.g., smp_*mb()) to prevent both the compiler and CPU from re-ordering access. A malicious guest may be able to cause a hypervisor crash resulting in a Denial of Service (DoS). Information leak and privilege escalation cannot be excluded. Systems running all versions of Xen are affected. Whether a system is vulnerable will depend on the CPU and compiler used to build Xen. For all systems, the presence and the scope of the vulnerability depend on the precise re-ordering performed by the compiler used to build Xen. We have not been able to survey compilers; consequently we cannot say which compiler(s) might produce vulnerable code (with which code generation options). GCC documentation clearly suggests that re-ordering is possible. Arm systems will also be vulnerable if the CPU is able to re-order memory access. Please consult your CPU vendor. x86 systems are only vulnerable if a compiler performs re-ordering.","status":"published","published":"2020-09-23T21:34:56Z","modified":"2024-08-04T15:33:05Z","updated_at":"2026-11-03T03:07:17.317062Z"}],"ghsa":[{"id":"GHSA-27c2-9cc9-22v7","title":"An issue was discovered in Xen through 4.14.x. There are missing memory barriers when accessing...","description":"An issue was discovered in Xen through 4.14.x. There are missing memory barriers when accessing/allocating an event channel. Event channels control structures can be accessed lockless as long as the port is considered to be valid. Such a sequence is missing an appropriate memory barrier (e.g., smp_*mb()) to prevent both the compiler and CPU from re-ordering access. A malicious guest may be able to cause a hypervisor crash resulting in a Denial of Service (DoS). Information leak and privilege escalation cannot be excluded. Systems running all versions of Xen are affected. Whether a system is vulnerable will depend on the CPU and compiler used to build Xen. For all systems, the presence and the scope of the vulnerability depend on the precise re-ordering performed by the compiler used to build Xen. We have not been able to survey compilers; consequently we cannot say which compiler(s) might produce vulnerable code (with which code generation options). GCC documentation clearly suggests that re-ordering is possible. Arm systems will also be vulnerable if the CPU is able to re-order memory access. Please consult your CPU vendor. x86 systems are only vulnerable if a compiler performs re-ordering.","status":"published","published":"2022-05-24T17:29:23Z","modified":"2023-01-29T05:04:39Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-401","CWE-670"],"updated_at":"2026-11-02T14:45:36.557586Z"}],"nvd":[{"id":"CVE-2020-25603","description":"An issue was discovered in Xen through 4.14.x. There are missing memory barriers when accessing/allocating an event channel. Event channels control structures can be accessed lockless as long as the port is considered to be valid. Such a sequence is missing an appropriate memory barrier (e.g., smp_*mb()) to prevent both the compiler and CPU from re-ordering access. A malicious guest may be able to cause a hypervisor crash resulting in a Denial of Service (DoS). Information leak and privilege escalation cannot be excluded. Systems running all versions of Xen are affected. Whether a system is vulnerable will depend on the CPU and compiler used to build Xen. For all systems, the presence and the scope of the vulnerability depend on the precise re-ordering performed by the compiler used to build Xen. We have not been able to survey compilers; consequently we cannot say which compiler(s) might produce vulnerable code (with which code generation options). GCC documentation clearly suggests that re-ordering is possible. Arm systems will also be vulnerable if the CPU is able to re-order memory access. Please consult your CPU vendor. x86 systems are only vulnerable if a compiler performs re-ordering.","status":"published","published":"2020-09-23T22:15:13.853Z","modified":"2026-06-17T03:06:57.9Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-670"],"updated_at":"2026-11-02T14:06:15.83396Z"}],"osv":[{"id":"ALPINE-CVE-2020-25603","description":"An issue was discovered in Xen through 4.14.x. There are missing memory barriers when accessing/allocating an event channel. Event channels control structures can be accessed lockless as long as the port is considered to be valid. Such a sequence is missing an appropriate memory barrier (e.g., smp_*mb()) to prevent both the compiler and CPU from re-ordering access. A malicious guest may be able to cause a hypervisor crash resulting in a Denial of Service (DoS). Information leak and privilege escalation cannot be excluded. Systems running all versions of Xen are affected. Whether a system is vulnerable will depend on the CPU and compiler used to build Xen. For all systems, the presence and the scope of the vulnerability depend on the precise re-ordering performed by the compiler used to build Xen. We have not been able to survey compilers; consequently we cannot say which compiler(s) might produce vulnerable code (with which code generation options). GCC documentation clearly suggests that re-ordering is possible. Arm systems will also be vulnerable if the CPU is able to re-order memory access. Please consult your CPU vendor. x86 systems are only vulnerable if a compiler performs re-ordering.","status":"published","published":"2020-09-23T22:15:13.853Z","modified":"2026-10-26T11:17:55.153972272Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:48.11886Z"},{"id":"CVE-2020-25603","description":"An issue was discovered in Xen through 4.14.x. There are missing memory barriers when accessing/allocating an event channel. Event channels control structures can be accessed lockless as long as the port is considered to be valid. Such a sequence is missing an appropriate memory barrier (e.g., smp_*mb()) to prevent both the compiler and CPU from re-ordering access. A malicious guest may be able to cause a hypervisor crash resulting in a Denial of Service (DoS). Information leak and privilege escalation cannot be excluded. Systems running all versions of Xen are affected. Whether a system is vulnerable will depend on the CPU and compiler used to build Xen. For all systems, the presence and the scope of the vulnerability depend on the precise re-ordering performed by the compiler used to build Xen. We have not been able to survey compilers; consequently we cannot say which compiler(s) might produce vulnerable code (with which code generation options). GCC documentation clearly suggests that re-ordering is possible. Arm systems will also be vulnerable if the CPU is able to re-order memory access. Please consult your CPU vendor. x86 systems are only vulnerable if a compiler performs re-ordering.","status":"published","published":"2020-09-23T22:15:13.853Z","modified":"2026-03-14T10:06:53.880416Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:15.879068Z"},{"id":"DEBIAN-CVE-2020-25603","description":"An issue was discovered in Xen through 4.14.x. There are missing memory barriers when accessing/allocating an event channel. Event channels control structures can be accessed lockless as long as the port is considered to be valid. Such a sequence is missing an appropriate memory barrier (e.g., smp_*mb()) to prevent both the compiler and CPU from re-ordering access. A malicious guest may be able to cause a hypervisor crash resulting in a Denial of Service (DoS). Information leak and privilege escalation cannot be excluded. Systems running all versions of Xen are affected. Whether a system is vulnerable will depend on the CPU and compiler used to build Xen. For all systems, the presence and the scope of the vulnerability depend on the precise re-ordering performed by the compiler used to build Xen. We have not been able to survey compilers; consequently we cannot say which compiler(s) might produce vulnerable code (with which code generation options). GCC documentation clearly suggests that re-ordering is possible. Arm systems will also be vulnerable if the CPU is able to re-order memory access. Please consult your CPU vendor. x86 systems are only vulnerable if a compiler performs re-ordering.","status":"published","published":"2020-09-23T22:15:13.853Z","modified":"2026-10-26T12:02:40.27918372Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:33.729655Z"},{"id":"UBUNTU-CVE-2020-25603","description":"An issue was discovered in Xen through 4.14.x. There are missing memory barriers when accessing/allocating an event channel. Event channels control structures can be accessed lockless as long as the port is considered to be valid. Such a sequence is missing an appropriate memory barrier (e.g., smp_*mb()) to prevent both the compiler and CPU from re-ordering access. A malicious guest may be able to cause a hypervisor crash resulting in a Denial of Service (DoS). Information leak and privilege escalation cannot be excluded. Systems running all versions of Xen are affected. Whether a system is vulnerable will depend on the CPU and compiler used to build Xen. For all systems, the presence and the scope of the vulnerability depend on the precise re-ordering performed by the compiler used to build Xen. We have not been able to survey compilers; consequently we cannot say which compiler(s) might produce vulnerable code (with which code generation options). GCC documentation clearly suggests that re-ordering is possible. Arm systems will also be vulnerable if the CPU is able to re-order memory access. Please consult your CPU vendor. x86 systems are only vulnerable if a compiler performs re-ordering.","status":"published","published":"2020-09-23T22:15:00Z","modified":"2026-04-22T12:35:00.420334Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:23.905183Z"},{"id":"DSA-4769-1","title":"xen - security update","status":"published","published":"2020-10-02T00:00:00Z","modified":"2026-03-09T02:10:53.28732Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"openSUSE-SU-2020:1608-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2020-25602: Fixed an issue where there was a crash when\n  handling guest access to MSR_MISC_ENABLE was thrown (bsc#1176339,XSA-333)\n- CVE-2020-25598: Added a missing unlock in XENMEM_acquire_resource error path\n  (bsc#1176341,XSA-334)\n- CVE-2020-25604: Fixed a race condition when migrating timers between x86 \n  HVM vCPU-s (bsc#1176343,XSA-336)\n- CVE-2020-25595: Fixed an issue where PCI passthrough code was reading back hardware registers (bsc#1176344,XSA-337)\n- CVE-2020-25597: Fixed an issue where a valid event channels may not turn invalid (bsc#1176346,XSA-338)\n- CVE-2020-25596: Fixed a potential denial of service in x86 pv guest kernel via SYSENTER (bsc#1176345,XSA-339)\n- CVE-2020-25603: Fixed an issue due to  missing barriers when accessing/allocating an event channel (bsc#1176347,XSA-340)\n- CVE-2020-25600: Fixed out of bounds event channels available to 32-bit x86 domains (bsc#1176348,XSA-342)\n- CVE-2020-25599: Fixed race conditions with evtchn_reset() (bsc#1176349,XSA-343)\n- CVE-2020-25601: Fixed an issue due to lack of preemption in evtchn_reset() / evtchn_destroy() (bsc#1176350,XSA-344)\n- Various other fixes (bsc#1027519)\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2020-10-04T04:23:35Z","modified":"2026-02-04T03:56:06.537967Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2024:11520-1","title":"xen-4.15.1_01-1.2 on GA media","description":"These are all security issues fixed in the xen-4.15.1_01-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:22.378535Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2020:14521-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2020-0543: Fixed a leak of Special Register Buffer Data Sampling (SRBDS) aka 'CrossTalk' (bsc#1172205,XSA-320)\n- CVE-2020-14364: Fixed an out-of-bounds read/write access while processing usb packets (bsc#1175534).\n- CVE-2020-15565: Fixed an issue cache write (bsc#1173378,XSA-321).\n- CVE-2020-15567: Fixed an issue with non-atomic  modification of live EPT PTE (bsc#1173380,XSA-328)\n- CVE-2020-25595: Fixed an issue where PCI passthrough code was reading back hardware registers (bsc#1176344,XSA-337)\n- CVE-2020-25596: Fixed a potential denial of service in x86 pv guest kernel via SYSENTER (bsc#1176345,XSA-339)\n- CVE-2020-25597: Fixed an issue where a valid event channels may not turn invalid (bsc#1176346,XSA-338)\n- CVE-2020-25600: Fixed out of bounds event channels available to 32-bit x86 domains (bsc#1176348,XSA-342)\n- CVE-2020-25601: Fixed an issue due to lack of preemption in evtchn_reset() / evtchn_destroy() (bsc#1176350,XSA-344)\t  \n- CVE-2020-25603: Fixed an issue due to  missing barriers when accessing/allocating an event channel (bsc#1176347,XSA-340)\n- CVE-2020-25604: Fixed a race condition when migrating timers between x86 \n  HVM vCPU-s (bsc#1176343,XSA-336)\n","status":"published","published":"2020-10-22T12:09:09Z","modified":"2026-02-04T04:01:17.164532Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:2786-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2020-25602: Fixed an issue where there was a crash when\n  handling guest access to MSR_MISC_ENABLE was thrown (bsc#1176339,XSA-333)\n- CVE-2020-25598: Added a missing unlock in XENMEM_acquire_resource error path\n  (bsc#1176341,XSA-334)\n- CVE-2020-25604: Fixed a race condition when migrating timers between x86 \n  HVM vCPU-s (bsc#1176343,XSA-336)\n- CVE-2020-25595: Fixed an issue where PCI passthrough code was reading back hardware registers (bsc#1176344,XSA-337)\n- CVE-2020-25597: Fixed an issue where a valid event channels may not turn invalid (bsc#1176346,XSA-338)\n- CVE-2020-25596: Fixed a potential denial of service in x86 pv guest kernel via SYSENTER (bsc#1176345,XSA-339)\n- CVE-2020-25603: Fixed an issue due to  missing barriers when accessing/allocating an event channel (bsc#1176347,XSA-340)\n- CVE-2020-25600: Fixed out of bounds event channels available to 32-bit x86 domains (bsc#1176348,XSA-342)\n- CVE-2020-25599: Fixed race conditions with evtchn_reset() (bsc#1176349,XSA-343)\n- CVE-2020-25601: Fixed an issue due to lack of preemption in evtchn_reset() / evtchn_destroy() (bsc#1176350,XSA-344)\t  \n- CVE-2020-14364: Fixed an out-of-bounds read/write access while processing usb packets (bsc#1175534).\n- Various bug fixes (bsc#1027519)\t  \n","status":"published","published":"2020-09-29T12:12:25Z","modified":"2026-02-04T04:28:35.545627Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:2787-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2020-25604: Fixed a race condition when migrating timers between x86 \n  HVM vCPU-s (bsc#1176343,XSA-336)\n- CVE-2020-25595: Fixed an issue where PCI passthrough code was reading back hardware registers (bsc#1176344,XSA-337)\n- CVE-2020-25597: Fixed an issue where a valid event channels may not turn invalid (bsc#1176346,XSA-338)\n- CVE-2020-25596: Fixed a potential denial of service in x86 pv guest kernel via SYSENTER (bsc#1176345,XSA-339)\n- CVE-2020-25603: Fixed an issue due to  missing barriers when accessing/allocating an event channel (bsc#1176347,XSA-340)\n- CVE-2020-25600: Fixed out of bounds event channels available to 32-bit x86 domains (bsc#1176348,XSA-342)\n- CVE-2020-25599: Fixed race conditions with evtchn_reset() (bsc#1176349,XSA-343)\n- CVE-2020-25601: Fixed an issue due to lack of preemption in evtchn_reset() / evtchn_destroy() (bsc#1176350,XSA-344)\t  \n- CVE-2020-14364: Fixed an out-of-bounds read/write access while processing usb packets (bsc#1175534).\n- Various bug fixes (bsc#1027519)\n","status":"published","published":"2020-09-29T12:12:46Z","modified":"2026-02-04T04:28:42.019793Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:2788-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2020-25602: Fixed an issue where there was a crash when\n  handling guest access to MSR_MISC_ENABLE was thrown (bsc#1176339,XSA-333)\n- CVE-2020-25598: Added a missing unlock in XENMEM_acquire_resource error path\n  (bsc#1176341,XSA-334)\n- CVE-2020-25604: Fixed a race condition when migrating timers between x86 \n  HVM vCPU-s (bsc#1176343,XSA-336)\n- CVE-2020-25595: Fixed an issue where PCI passthrough code was reading back hardware registers (bsc#1176344,XSA-337)\n- CVE-2020-25597: Fixed an issue where a valid event channels may not turn invalid (bsc#1176346,XSA-338)\n- CVE-2020-25596: Fixed a potential denial of service in x86 pv guest kernel via SYSENTER (bsc#1176345,XSA-339)\n- CVE-2020-25603: Fixed an issue due to  missing barriers when accessing/allocating an event channel (bsc#1176347,XSA-340)\n- CVE-2020-25600: Fixed out of bounds event channels available to 32-bit x86 domains (bsc#1176348,XSA-342)\n- CVE-2020-25599: Fixed race conditions with evtchn_reset() (bsc#1176349,XSA-343)\n- CVE-2020-25601: Fixed an issue due to lack of preemption in evtchn_reset() / evtchn_destroy() (bsc#1176350,XSA-344)\t  \n- CVE-2020-14364: Fixed an out-of-bounds read/write access while processing usb packets (bsc#1175534).\n- Various bug fixes (bsc#1027519)\n","status":"published","published":"2020-09-29T12:13:04Z","modified":"2026-02-04T02:13:28.886469Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:2789-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\t  \n- CVE-2020-25604: Fixed a race condition when migrating timers between x86 \n  HVM vCPU-s (bsc#1176343,XSA-336)\n- CVE-2020-25595: Fixed an issue where PCI passthrough code was reading back hardware registers (bsc#1176344,XSA-337)\n- CVE-2020-25597: Fixed an issue where a valid event channels may not turn invalid (bsc#1176346,XSA-338)\n- CVE-2020-25596: Fixed a potential denial of service in x86 pv guest kernel via SYSENTER (bsc#1176345,XSA-339)\n- CVE-2020-25603: Fixed an issue due to  missing barriers when accessing/allocating an event channel (bsc#1176347,XSA-340)\n- CVE-2020-25600: Fixed out of bounds event channels available to 32-bit x86 domains (bsc#1176348,XSA-342)\n- CVE-2020-25599: Fixed race conditions with evtchn_reset() (bsc#1176349,XSA-343)\n- CVE-2020-25601: Fixed an issue due to lack of preemption in evtchn_reset() / evtchn_destroy() (bsc#1176350,XSA-344)\n","status":"published","published":"2020-09-29T12:13:18Z","modified":"2026-02-04T03:24:53.873587Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:2790-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2020-25602: Fixed an issue where there was a crash when\n  handling guest access to MSR_MISC_ENABLE was thrown (bsc#1176339,XSA-333)\n- CVE-2020-25598: Added a missing unlock in XENMEM_acquire_resource error path\n  (bsc#1176341,XSA-334)\n- CVE-2020-25604: Fixed a race condition when migrating timers between x86 \n  HVM vCPU-s (bsc#1176343,XSA-336)\n- CVE-2020-25595: Fixed an issue where PCI passthrough code was reading back hardware registers (bsc#1176344,XSA-337)\n- CVE-2020-25597: Fixed an issue where a valid event channels may not turn invalid (bsc#1176346,XSA-338)\n- CVE-2020-25596: Fixed a potential denial of service in x86 pv guest kernel via SYSENTER (bsc#1176345,XSA-339)\n- CVE-2020-25603: Fixed an issue due to  missing barriers when accessing/allocating an event channel (bsc#1176347,XSA-340)\n- CVE-2020-25600: Fixed out of bounds event channels available to 32-bit x86 domains (bsc#1176348,XSA-342)\n- CVE-2020-25599: Fixed race conditions with evtchn_reset() (bsc#1176349,XSA-343)\n- CVE-2020-25601: Fixed an issue due to lack of preemption in evtchn_reset() / evtchn_destroy() (bsc#1176350,XSA-344)\t  \n\n- Various bug fixes (bsc#1027519)\n","status":"published","published":"2020-09-29T12:13:34Z","modified":"2025-05-02T04:10:04.356974Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:2791-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2020-25602: Fixed an issue where there was a crash when\n  handling guest access to MSR_MISC_ENABLE was thrown (bsc#1176339,XSA-333)\n- CVE-2020-25598: Added a missing unlock in XENMEM_acquire_resource error path\n  (bsc#1176341,XSA-334)\n- CVE-2020-25604: Fixed a race condition when migrating timers between x86 \n  HVM vCPU-s (bsc#1176343,XSA-336)\n- CVE-2020-25595: Fixed an issue where PCI passthrough code was reading back hardware registers (bsc#1176344,XSA-337)\n- CVE-2020-25597: Fixed an issue where a valid event channels may not turn invalid (bsc#1176346,XSA-338)\n- CVE-2020-25596: Fixed a potential denial of service in x86 pv guest kernel via SYSENTER (bsc#1176345,XSA-339)\n- CVE-2020-25603: Fixed an issue due to  missing barriers when accessing/allocating an event channel (bsc#1176347,XSA-340)\n- CVE-2020-25600: Fixed out of bounds event channels available to 32-bit x86 domains (bsc#1176348,XSA-342)\n- CVE-2020-25599: Fixed race conditions with evtchn_reset() (bsc#1176349,XSA-343)\n- CVE-2020-25601: Fixed an issue due to lack of preemption in evtchn_reset() / evtchn_destroy() (bsc#1176350,XSA-344)\n- Various other fixes (bsc#1027519)\n","status":"published","published":"2020-09-29T12:13:49Z","modified":"2026-02-04T04:29:23.874597Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:2822-1","title":"Security update for xen","description":"This update for xen fixes the following issues:\n\n- CVE-2020-25604: Fixed a race condition when migrating timers between x86 \n  HVM vCPU-s (bsc#1176343,XSA-336)\n- CVE-2020-25595: Fixed an issue where PCI passthrough code was reading back hardware registers (bsc#1176344,XSA-337)\n- CVE-2020-25597: Fixed an issue where a valid event channels may not turn invalid (bsc#1176346,XSA-338)\n- CVE-2020-25596: Fixed a potential denial of service in x86 pv guest kernel via SYSENTER (bsc#1176345,XSA-339)\n- CVE-2020-25603: Fixed an issue due to  missing barriers when accessing/allocating an event channel (bsc#1176347,XSA-340)\n- CVE-2020-25600: Fixed out of bounds event channels available to 32-bit x86 domains (bsc#1176348,XSA-342)\n- CVE-2020-25599: Fixed race conditions with evtchn_reset() (bsc#1176349,XSA-343)\n- CVE-2020-25601: Fixed an issue due to lack of preemption in evtchn_reset() / evtchn_destroy() (bsc#1176350,XSA-344)\t  \n- CVE-2020-14364: Fixed an out-of-bounds read/write access while processing usb packets (bsc#1175534).\n- CVE-2020-0543: Fixed a leak of Special Register Buffer Data Sampling (SRBDS) aka 'CrossTalk' (bsc#1172205,XSA-320)\n- CVE-2020-15565: Fixed an issue cache write (bsc#1173378,XSA-321).\n- CVE-2020-15567: Fixed an issue with non-atomic  modification of live EPT PTE (bsc#1173380,XSA-328)\n","status":"published","published":"2020-10-01T10:33:59Z","modified":"2026-02-04T03:08:39.358915Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"USN-5617-1","title":"xen vulnerabilities","description":"It was discovered that memory contents previously stored in\nmicroarchitectural special registers after RDRAND, RDSEED, and SGX EGETKEY\nread operations on Intel client and Xeon E3 processors may be briefly\nexposed to processes on the same or different processor cores. A local\nattacker could use this to expose sensitive information. (CVE-2020-0543)\n\nJulien Grall discovered that Xen incorrectly handled memory barriers on\nARM-based systems. An attacker could possibly use this issue to cause a\ndenial of service, obtain sensitive information or escalate privileges.\n(CVE-2020-11739)\n\nIlja Van Sprundel discovered that Xen incorrectly handled profiling of\nguests. An unprivileged attacker could use this issue to obtain sensitive\ninformation from other guests, cause a denial of service or possibly gain\nprivileges. (CVE-2020-11740, CVE-2020-11741)\n\nIt was discovered that Xen incorrectly handled grant tables. A malicious\nguest could possibly use this issue to cause a denial of service.\n(CVE-2020-11742, CVE-2020-11743)\n\nJan Beulich discovered that Xen incorrectly handled certain code paths. An\nattacker could possibly use this issue to cause a denial of service.\n(CVE-2020-15563)\n\nJulien Grall discovered that Xen incorrectly verified memory addresses\nprovided by the guest on ARM-based systems. A malicious guest administrator\ncould possibly use this issue to cause a denial of service. (CVE-2020-15564)\n\nRoger Pau Monné discovered that Xen incorrectly handled caching on x86 Intel\nsystems. An attacker could possibly use this issue to cause a denial of\nservice. (CVE-2020-15565)\n\nIt was discovered that Xen incorrectly handled error in event-channel port\nallocation. A malicious guest could possibly use this issue to cause a\ndenial of service. (CVE-2020-15566)\n\nJan Beulich discovered that Xen incorrectly handled certain EPT (Extended\nPage Tables).  An attacker could possibly use this issue to cause a denial\nof service, data corruption or privilege escalation. (CVE-2020-15567)\n\nAndrew Cooper discovered that Xen incorrectly handled PCI passthrough.\nAn attacker could possibly use this issue to cause a denial of service.\n(CVE-2020-25595)\n\nAndrew Cooper discovered that Xen incorrectly sanitized path injections.\nAn attacker could possibly use this issue to cause a denial of service.\n(CVE-2020-25596)\n\nJan Beulich discovered that Xen incorrectly handled validation of event\nchannels. An attacker could possibly use this issue to cause a denial\nof service. (CVE-2020-25597)\n\nJulien Grall and Jan Beulich discovered that Xen incorrectly handled\nresetting event channels. An attacker could possibly use this issue to\ncause a denial of service or obtain sensitive information. (CVE-2020-25599)\n\nJulien Grall discovered that Xen incorrectly handled event channels\nmemory allocation on 32-bits domains. An attacker could possibly use this\nissue to cause a denial of service. (CVE-2020-25600)\n\nJan Beulich discovered that Xen incorrectly handled resetting or cleaning\nup event channels. An attacker could possibly use this issue to cause a\ndenial of service. (CVE-2020-25601)\n\nAndrew Cooper discovered that Xen incorrectly handled certain Intel\nspecific MSR (Model Specific Registers). An attacker could possibly use\nthis issue to cause a denial of service. (CVE-2020-25602)\n\nJulien Grall discovered that Xen incorrectly handled accessing/allocating\nevent channels. An attacker could possibly use this issue to cause a\ndenial of service, obtain sensitive information of privilege escalation.\n(CVE-2020-25603)\n\nIgor Druzhinin discovered that Xen incorrectly handled locks. An attacker\ncould possibly use this issue to cause a denial of service. (CVE-2020-25604)\n","status":"published","published":"2022-09-19T16:56:10Z","modified":"2026-04-27T16:32:22.079286043Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}