Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2020-11743: Xen on Debian and Alpine can crash when guest misbehaves
CVE-2020-11743 · published 6 years ago
Summary
The Xen virtualization platform in Debian and Alpine Linux versions up to 4.13 can stop working if a virtual machine (guest) triggers a specific error in the grant‑table feature. This error causes the host system (dom0) or other virtual machines to crash, potentially disrupting services. Update Xen to a version that includes the fix or apply the vendor's recommended patch to prevent the crash.
What to do
- Update debian xen to version 4.11.4-1.
- Update alpine xen to version 4.12.2-r1.
- Update alpine xen to version 4.13.0-r1.
- Update alpine xen to version 4.13.0-r3.
- Update alpine xen to version 4.10.4-r3.
- Update alpine xen to version 4.11.3-r2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | xen |
< 4.11.4-1 Fix: upgrade to 4.11.4-1
|
| Debian:13 | debian | xen |
< 4.11.4-1 Fix: upgrade to 4.11.4-1
|
| Debian:14 | debian | xen |
< 4.11.4-1 Fix: upgrade to 4.11.4-1
|
| Alpine:v3.10 | alpine | xen |
< 4.12.2-r1 Fix: upgrade to 4.12.2-r1
|
| Alpine:v3.11 | alpine | xen |
< 4.13.0-r1 Fix: upgrade to 4.13.0-r1
|
| Alpine:v3.12 | alpine | xen |
< 4.13.0-r3 Fix: upgrade to 4.13.0-r3
|
| Alpine:v3.8 | alpine | xen |
< 4.10.4-r3 Fix: upgrade to 4.10.4-r3
|
| Alpine:v3.9 | alpine | xen |
< 4.11.3-r2 Fix: upgrade to 4.11.3-r2
|
| – | xen | xen |
<= 4.13.0 4.13.0 cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:* |
| – | fedoraproject | fedora |
32 cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* |
Original advisory text
An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service because of a bad error path in GNTTABOP_map_grant. Grant table operations are expected to return ...
An issue was discovered in Xen through 4.13.x, allowing guest OS users to cause a denial of service because of a bad error path in GNTTABOP_map_grant. Grant table operations are expected to return 0 for success, and a negative number for errors. Some misplaced brackets cause one error path to return 1 instead of a negative value. The grant table code in Linux treats this condition as success, and proceeds with incorrectly initialised state. A buggy or malicious guest can construct its grant table in such a way that, when a backend domain tries to map a grant, it hits the incorrect error path. This will crash a Linux based dom0 or backend domain.
References
- https://security-tracker.debian.org/tracker/CVE-2020-11743 Vendor Advisory
- https://security.alpinelinux.org/vuln/CVE-2020-11743 Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00006.html
- http://www.openwall.com/lists/oss-security/2020/04/14/3 Patch Third Party Advisory
- http://xenbits.xen.org/xsa/advisory-316.html Exploit Vendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
- https://security.gentoo.org/glsa/202005-08
- https://www.debian.org/security/2020/dsa-4723
- https://xenbits.xen.org/xsa/advisory-316.html Exploit Vendor Advisory
Severity
5.5
Medium
Type
CWE-755Improper Handling of Exceptional Conditions
Timeline
Published14 Apr 2020
Updated4 Nov 2026
First seen11 Sep 2026
Track software like this
Free during beta