CVE-2020-29479 Missing authorization in n/a
Unprivileged guests can delete the root xenstore node causing host-wide denial of service or modify permissions due to missing checks in oxenstored.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-29479?
CVE-2020-29479 is a high-severity missing authorization vulnerability in Debian Debian Linux, published on 15 Dec 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An issue was discovered in Xen through 4.14.x. In the Ocaml xenstored implementation, the internal representation of the tree has special cases for the root node, because this node has no parent. Unfortunately, permissions were not checked for certain operations on the root node. Unprivileged guests can get and modify permissions, list, and delete the root node. (Deleting the whole xenstore tree is a host-wide denial of service.) Achieving xenstore write access is also possible. All systems using oxenstored are vulnerable. Building and using oxenstored is the default in the upstream Xen distribution, if the Ocaml compiler is available. Systems using C xenstored are not vulnerable.
Weakness: CWE-862
Which versions are affected by CVE-2020-29479?
It affects 3 products.
Products include Debian Debian Linux, Fedoraproject Fedora, Xen Xen.
How do I fix CVE-2020-29479?
Apply the vendor's patch.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2020-29479 being exploited?
There is no known exploitation of CVE-2020-29479 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2020-29479, DEBIAN-CVE-2020-29479, GHSA-mrwx-r54g-7x9f, UBUNTU-CVE-2020-29479.