Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2020-11740: Xen lets guest users view other guests' data
CVE-2020-11740 · published 6 years ago
Summary
The Xen virtualization platform (used in Debian and Alpine) lets a virtual machine read memory buffers that belong to other virtual machines, even when profiling is not active. This can expose sensitive information from neighboring guests. Upgrade Xen to a version that includes the fix or apply the vendor's security patch.
What to do
- Update debian xen to version 4.11.4-1.
- Update alpine xen to version 4.12.2-r1.
- Update alpine xen to version 4.13.0-r1.
- Update alpine xen to version 4.13.0-r3.
- Update alpine xen to version 4.10.4-r3.
- Update alpine xen to version 4.11.3-r2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | xen |
< 4.11.4-1 Fix: upgrade to 4.11.4-1
|
| Debian:13 | debian | xen |
< 4.11.4-1 Fix: upgrade to 4.11.4-1
|
| Debian:14 | debian | xen |
< 4.11.4-1 Fix: upgrade to 4.11.4-1
|
| Alpine:v3.10 | alpine | xen |
>= 3.2.0, < 4.12.2-r1 Fix: upgrade to 4.12.2-r1
|
| Alpine:v3.11 | alpine | xen |
>= 3.2.0, < 4.13.0-r1 Fix: upgrade to 4.13.0-r1
|
| Alpine:v3.12 | alpine | xen |
>= 3.2.0, < 4.13.0-r3 Fix: upgrade to 4.13.0-r3
|
| Alpine:v3.8 | alpine | xen |
>= 3.2.0, < 4.10.4-r3 Fix: upgrade to 4.10.4-r3
|
| Alpine:v3.9 | alpine | xen |
>= 3.2.0, < 4.11.3-r2 Fix: upgrade to 4.11.3-r2
|
| – | xen | xen |
>= 3.2.0, <= 4.13.0 4.13.0 cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:* |
| – | debian | debian_linux |
10.0 cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
| – | fedoraproject | fedora |
30 31 32 cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* |
| – | opensuse | leap |
15.1 cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* |
Original advisory text
An issue was discovered in xenoprof in Xen through 4.13.x, allowing guest OS users (without active profiling) to obtain sensitive information about other guests. Unprivileged guests can request to ...
An issue was discovered in xenoprof in Xen through 4.13.x, allowing guest OS users (without active profiling) to obtain sensitive information about other guests. Unprivileged guests can request to map xenoprof buffers, even if profiling has not been enabled for those guests. These buffers were not scrubbed.
References
- https://security-tracker.debian.org/tracker/CVE-2020-11740 Vendor Advisory
- https://security.alpinelinux.org/vuln/CVE-2020-11740 Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00006.html Mailing List Third Party Advisory
- http://www.openwall.com/lists/oss-security/2020/04/14/1 Mailing List Patch Third Party Advisory
- http://xenbits.xen.org/xsa/advisory-313.html Patch Vendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
- https://security.gentoo.org/glsa/202005-08 Third Party Advisory
- https://www.debian.org/security/2020/dsa-4723 Third Party Advisory
- https://xenbits.xen.org/xsa/advisory-313.html Patch Vendor Advisory
Severity
5.5
Medium
Type
CWE-212Improper Removal of Sensitive Information Before Storage or Transfer
Timeline
Published14 Apr 2020
Updated4 Nov 2026
First seen11 Sep 2026
Track software like this
Free during beta