CVE-2020-29568 Denial of service in n/a
A malicious guest can trigger an out-of-memory condition in the Xen backend by flooding watch events, causing a denial of service on the host.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-29568?
CVE-2020-29568 is a medium-severity denial of service vulnerability in Debian Debian Linux, published on 15 Dec 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An issue was discovered in Xen through 4.14.x. Some OSes (such as Linux, FreeBSD, and NetBSD) are processing watch events using a single thread. If the events are received faster than the thread is able to handle, they will get queued. As the queue is unbounded, a guest may be able to trigger an OOM in the backend. All systems with a FreeBSD, Linux, or NetBSD (any version) dom0 are vulnerable.
Weakness: CWE-770
Which versions are affected by CVE-2020-29568?
It affects 2 products.
Products include Debian Debian Linux, Xen Xen.
How do I fix CVE-2020-29568?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-29568 being exploited?
There is no known exploitation of CVE-2020-29568 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2020-29568, DEBIAN-CVE-2020-29568, GHSA-583r-j6r6-x57h, UBUNTU-CVE-2020-29568.