Vulnerability Description
Xen through 4.14.x allows guest OS administrators to obtain sensitive information (such as AES keys from outside the guest) via a side-channel attack on a power/energy monitoring interface, aka a "Platypus" attack. NOTE: there is only one logically independent fix: to change the access control for each such interface in Xen.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Xen | Xen | <= 4.14.0 |
| Fedoraproject | Fedora | 32 |
| Debian | Debian Linux | 10.0 |
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2020/11/26/1Mailing ListThird Party Advisory
- http://xenbits.xen.org/xsa/advisory-351.htmlVendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://platypusattack.comThird Party Advisory
- https://www.debian.org/security/2020/dsa-4804Mailing ListThird Party Advisory
- https://www.zdnet.com/article/new-platypus-attack-can-steal-data-from-intel-cpusThird Party Advisory
- https://xenbits.xen.org/xsa/advisory-351.htmlPatchVendor Advisory
- http://www.openwall.com/lists/oss-security/2020/11/26/1Mailing ListThird Party Advisory
- http://xenbits.xen.org/xsa/advisory-351.htmlVendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://platypusattack.comThird Party Advisory
- https://www.debian.org/security/2020/dsa-4804Mailing ListThird Party Advisory
- https://www.zdnet.com/article/new-platypus-attack-can-steal-data-from-intel-cpusThird Party Advisory
FAQ
What is CVE-2020-28368?
CVE-2020-28368 is a vulnerability with a CVSS score of 4.4 (MEDIUM). Xen through 4.14.x allows guest OS administrators to obtain sensitive information (such as AES keys from outside the guest) via a side-channel attack on a power/energy monitoring interface, aka a "Pla...
How severe is CVE-2020-28368?
CVE-2020-28368 has been rated MEDIUM with a CVSS base score of 4.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-28368?
Check the references section above for vendor advisories and patch information. Affected products include: Xen Xen, Fedoraproject Fedora, Debian Debian Linux.