UBUNTU-CVE-2020-29569
An issue was discovered in the Linux kernel through 5.10.1, as used with Xen through 4.14.x. The Linux kernel PV block backend expects the kernel thread handler to reset ring->xenblkd to NULL when stopped. However, the handler may not have time to run if the frontend quickly toggles between the states connect and disconnect. As a consequence, the block backend may re-use a pointer after it was freed. A misbehaving guest can trigger a dom0 crash by continuously connecting / disconnecting a block frontend. Privilege escalation and information leaks cannot be ruled out. This only affects systems with a Linux blkback.
02 / AFFECTED SOFTWARE
Affected packages
90 explicit affected versions
50 explicit affected versions
6 explicit affected versions
6 explicit affected versions
57 explicit affected versions
20 explicit affected versions
38 explicit affected versions
11 explicit affected versions
68 explicit affected versions
23 explicit affected versions
1 explicit affected versions
1 explicit affected versions
12 explicit affected versions
1 explicit affected versions
7 explicit affected versions
12 explicit affected versions
1 explicit affected versions
22 explicit affected versions
30 explicit affected versions
58 explicit affected versions
21 explicit affected versions
13 explicit affected versions
10 explicit affected versions
36 explicit affected versions
7 explicit affected versions
57 explicit affected versions
35 explicit affected versions
1 explicit affected versions
1 explicit affected versions
1 explicit affected versions
29 explicit affected versions
13 explicit affected versions
52 explicit affected versions
1 explicit affected versions
24 explicit affected versions
32 explicit affected versions
10 explicit affected versions
11 explicit affected versions
92 explicit affected versions
22 explicit affected versions
2 explicit affected versions
55 explicit affected versions
18 explicit affected versions
60 explicit affected versions
1 explicit affected versions
123 explicit affected versions
2 explicit affected versions
14 explicit affected versions
68 explicit affected versions
1 explicit affected versions
17 explicit affected versions
12 explicit affected versions
1 explicit affected versions
12 explicit affected versions
1 explicit affected versions
14 explicit affected versions
3 explicit affected versions
79 explicit affected versions
11 explicit affected versions
37 explicit affected versions
44 explicit affected versions
16 explicit affected versions
7 explicit affected versions
38 explicit affected versions
9 explicit affected versions
101 explicit affected versions
12 explicit affected versions
84 explicit affected versions
36 explicit affected versions
45 explicit affected versions
6 explicit affected versions
11 explicit affected versions
43 explicit affected versions
1 explicit affected versions
12 explicit affected versions
15 explicit affected versions
4 explicit affected versions
2 explicit affected versions
1 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
An issue was discovered in the Linux kernel through 5.10.1, as used with Xen through 4.14.x. The Linux kernel PV block backend expects the kernel thread handler to reset ring->xenblkd to NULL when stopped. However, the handler may not have time to run if the frontend quickly toggles between the states connect and disconnect. As a consequence, the block backend may re-use a pointer after it was freed. A misbehaving guest can trigger a dom0 crash by continuously connecting / disconnecting a block frontend. Privilege escalation and information leaks cannot be ruled out. This only affects systems with a Linux blkback.
05 / REFERENCES
Further evidence
- https://ubuntu.com/security/CVE-2020-29569
- https://ubuntu.com/security/notices/USN-4749-1
- https://ubuntu.com/security/notices/USN-4750-1
- https://ubuntu.com/security/notices/USN-4751-1
- https://ubuntu.com/security/notices/USN-4876-1
- https://www.cve.org/CVERecord?id=CVE-2020-29569
- https://xenbits.xen.org/xsa/advisory-350.html