CVE-2020-29570

MediumCVSS 6.2/10Last modified Jun 17, 2026

Description

An issue was discovered in Xen through 4.14.x. Recording of the per-vCPU control block mapping maintained by Xen and that of pointers into the control block is reversed. The consumer assumes, seeing the former initialized, that the latter are also ready for use. Malicious or buggy guest kernels can mount a Denial of Service (DoS) attack affecting the entire system.

Metrics

CVSS 3.1 6.2/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published: Dec 15, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-295716.2An issue was discovered in Xen through 4.14.x. A bounds check common to most operation time functions specific to FIFO event channels depend CVE-2020-295726.1app/View/Elements/genericElements/SingleViews/Fields/genericField.ctp in MISP 2.4.135 has XSS via the authkey comment field.CVE-2020-295737.5sysdeps/i386/ldbl2mpn.c in the GNU C Library (aka glibc or libc6) before 2.23 on x86 targets has a stack-based buffer overflow if the input CVE-2020-295749.8An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL s CVE-2020-295759.8The official elixir Docker images before 1.8.0-alpine (Alpine specific) contain a blank password for a root user. Systems using the elixir L CVE-2020-295769.8The official eggdrop Docker images before 1.8.4rc2 contain a blank password for a root user. Systems using the Eggdrop Docker container depl CVE-2020-295779.8The official znc docker images before 1.7.1-slim contain a blank password for a root user. Systems using the znc docker container deployed b CVE-2020-295789.8The official piwik Docker images before fpm-alpine (Alpine specific) contain a blank password for a root user. Systems using the Piwik Docke CVE-2020-295799.8The official Express Gateway Docker images before 1.14.0 contain a blank password for a root user. Systems using the Express Gateway Docker CVE-2020-29587.5Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior CVE-2020-295809.8The official storm Docker images before 1.2.1 contain a blank password for a root user. Systems using the Storm Docker container deployed by CVE-2020-295819.8The official spiped docker images before 1.5-alpine contain a blank password for a root user. Systems using the spiped docker container depl