Vulnerability Details : CVE-2020-28368
Xen through 4.14.x allows guest OS administrators to obtain sensitive information (such as AES keys from outside the guest) via a side-channel attack on a power/energy monitoring interface, aka a "Platypus" attack. NOTE: there is only one logically independent fix: to change the access control for each such interface in Xen.
Products affected by CVE-2020-28368
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-28368
0.07%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 18 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-28368
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
2.1
|
LOW | AV:L/AC:L/Au:N/C:P/I:N/A:N |
3.9
|
2.9
|
NIST | |
|
4.4
|
MEDIUM | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N |
0.8
|
3.6
|
NIST |
CWE ids for CVE-2020-28368
-
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.Assigned by: nvd@nist.gov (Primary)
References for CVE-2020-28368
-
https://www.zdnet.com/article/new-platypus-attack-can-steal-data-from-intel-cpus/
New Platypus attack can steal data from Intel CPUs | ZDNetThird Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5J66QUUHXH2RR4CNCKQRGVXVSOUFRPDA/
[SECURITY] Fedora 33 Update: xen-4.14.0-12.fc33 - package-announce - Fedora Mailing-ListsThird Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XV23EZIMNLJN4YXRRXLQV2ALW6ZEALXV/
[SECURITY] Fedora 32 Update: xen-4.13.2-2.fc32 - package-announce - Fedora Mailing-ListsMailing List;Third Party Advisory
-
http://xenbits.xen.org/xsa/advisory-351.html
XSA-351 - Xen Security AdvisoriesVendor Advisory
-
https://xenbits.xen.org/xsa/advisory-351.html
XSA-351 - Xen Security AdvisoriesPatch;Vendor Advisory
-
https://www.debian.org/security/2020/dsa-4804
Debian -- Security Information -- DSA-4804-1 xenMailing List;Third Party Advisory
-
https://platypusattack.com
PLATYPUS: With Great Power comes Great LeakageThird Party Advisory
-
http://www.openwall.com/lists/oss-security/2020/11/26/1
oss-security - Xen Security Advisory 351 v2 (CVE-2020-28368) - Information leak via power sidechannelMailing List;Third Party Advisory
Jump to