Published: 10/11/2020 Updated: 07/11/2023

CVSS v2 Base Score: 2.1 | Impact Score: 2.9 | Exploitability Score: 3.9

CVSS v3 Base Score: 4.4 | Impact Score: 3.6 | Exploitability Score: 0.8

VMScore: 187

Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N

Xen up to and including 4.14.x allows guest OS administrators to obtain sensitive information (such as AES keys from outside the guest) via a side-channel attack on a power/energy monitoring interface, aka a "Platypus" attack. NOTE: there is only one logically independent fix: to change the access control for each such interface in Xen.

Vulnerable Product	Search on Vulmon	Subscribe to Product
xen xen
fedoraproject fedora 32
debian debian linux 10.0

Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in denial of service, privilege escalation or information leaks For the stable distribution (buster), these problems have been fixed in version 4114+57-g41a822c392-1 We recommend that you upgrade your xen packages For the detailed security status of xen ple ...

Description of Problem A security issue has been identified in Citrix Hypervisor that may allow privileged code running in a guest VM to infer details of some computations occurring in other VMs on the host  This may, for example, be used to infer a secret encryption key used by a web server in a different VM This issue has the following CVE ...

oss-sec mailing list archives   By Date By Thread </form>    Xen Security Advisory 351 v2 (CVE-2020-28368) - Information leak via power sidechannel  <!--X-Head- ...

CWE-862 https://platypusattack.com https://www.zdnet.com/article/new-platypus-attack-can-steal-data-from-intel-cpus/https://xenbits.xen.org/xsa/advisory-351.html http://www.openwall.com/lists/oss-security/2020/11/26/1 http://xenbits.xen.org/xsa/advisory-351.html https://www.debian.org/security/2020/dsa-4804 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XV23EZIMNLJN4YXRRXLQV2ALW6ZEALXV/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5J66QUUHXH2RR4CNCKQRGVXVSOUFRPDA/https://nvd.nist.gov https://www.debian.org/security/2020/dsa-4804

CVE-2020-28368

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Mailing Lists

References

Vulmon Search

About

Products

Connect