CVE-2020-11741

Name of the Vulnerable Software and Affected Versions Xen versions through 4.13.x

Description An issue in xenoprof allows guest OS users with active profiling to obtain sensitive information about other guests, cause a denial of service, or possibly gain privileges. The xenoprof code uses the standard Xen shared ring structure for guests with active profiling enabled by the administrator. However, it trusts the guest not to modify buffer size information or head/tail pointers in unexpected ways, which can lead to a host crash (DoS). Privilege escalation cannot be ruled out.

Recommendations For versions through 4.13.x, consider disabling active profiling for guest OS users until a patch is available to prevent potential exploitation. Restrict access to the xenoprof code to minimize the risk of denial of service or privilege escalation.