An issue was discovered in the Linux kernel 5.5 through 5.7.9, as used in Xen through 4.13.x for x86 PV guests. An attacker may be granted the I/O port permissions of an unrelated task. This occurs because tssinvalidateio_bitmap mishandling causes a loss of synchronization between the I/O bitmaps of TSS and Xen, aka CID-cadfad870154.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-15852.json"
[
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"193929421831590721050030113258276510659",
"86896033629953670169938555500406493238",
"148712175247434912618972778538582910989",
"76680413884311512479037421901697121205",
"287526453045095951918699700981044709900",
"262277563848801098201269989253184728278",
"127102701404963868442844136930958552858"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2020-15852-0196bb69",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@cadfad870154e14f745ec845708bc17d166065f2",
"target": {
"file": "arch/x86/include/asm/io_bitmap.h"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"50746706567437524267271875088073571258",
"206358163664779418131489839478801588517",
"86803360504713482117185565600226898114",
"280489078718345262240759496570129439689"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2020-15852-26f6994c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@cadfad870154e14f745ec845708bc17d166065f2",
"target": {
"file": "arch/x86/kernel/paravirt.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"35128875697175228389017966578718690797",
"145989667483504088586280973990949560721",
"320935880624631404944127611246296373162",
"234210654846628432821158081525999095001",
"225682246327555539699063903018837689058",
"274058826386273978746460512746551097457",
"132044136146813834733311191213284975260",
"28873377527141776858116081835056053930"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2020-15852-32388105",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@cadfad870154e14f745ec845708bc17d166065f2",
"target": {
"file": "arch/x86/xen/enlighten_pv.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 113.0,
"function_hash": "313958508051760420177791029351034372385"
},
"signature_type": "Function",
"id": "CVE-2020-15852-54888fd7",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@cadfad870154e14f745ec845708bc17d166065f2",
"target": {
"function": "tss_invalidate_io_bitmap",
"file": "arch/x86/kernel/process.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 128.0,
"function_hash": "60949817877343863595163044703890291238"
},
"signature_type": "Function",
"id": "CVE-2020-15852-7ff702d8",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@cadfad870154e14f745ec845708bc17d166065f2",
"target": {
"function": "switch_to_bitmap",
"file": "arch/x86/kernel/process.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 511.0,
"function_hash": "218680969284071176858667921728374769154"
},
"signature_type": "Function",
"id": "CVE-2020-15852-84a13050",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@cadfad870154e14f745ec845708bc17d166065f2",
"target": {
"function": "native_tss_update_io_bitmap",
"file": "arch/x86/kernel/process.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"266381336469145337718395830461612324251",
"213503916354829288831893125131307488966",
"149107136255041520667296886645905432568",
"210773113047440804168059138697734501702"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2020-15852-a41a4eec",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@cadfad870154e14f745ec845708bc17d166065f2",
"target": {
"file": "arch/x86/include/asm/paravirt_types.h"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"292377201986124426088374945784002966385",
"82027770061158552329211272843427036891",
"116839325408544462398063348905056937035",
"4664274812866225501410741842704629509"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2020-15852-cbc3f408",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@cadfad870154e14f745ec845708bc17d166065f2",
"target": {
"file": "arch/x86/include/asm/paravirt.h"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"149921550918727571907189110443842496643",
"16294634606765744740476519747333442670",
"279113980104009553361647971717690076502",
"225849507462775144258958032337569164610",
"190658076037502144011098504408544036372",
"302265099600417677401577768880331274635",
"25233635992272401680648963616499509197",
"73842491061418389751364385796250984518",
"314124580815919915997416684083256132993",
"53874702892124586570622750154909258727",
"172966308511962481184146974309250997591",
"174531503454734574704479596954040640018",
"8305607077955296443434149897321567986",
"67428421651840851170164803453245716109",
"66859524405014599920913116165812984274"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2020-15852-eab4dfcc",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@cadfad870154e14f745ec845708bc17d166065f2",
"target": {
"file": "arch/x86/kernel/process.c"
}
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-15852.json"
[
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"266381336469145337718395830461612324251",
"213503916354829288831893125131307488966",
"149107136255041520667296886645905432568",
"210773113047440804168059138697734501702"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2020-15852-0adfae05",
"source": "https://github.com/torvalds/linux/commit/cadfad870154e14f745ec845708bc17d166065f2",
"target": {
"file": "arch/x86/include/asm/paravirt_types.h"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"193929421831590721050030113258276510659",
"86896033629953670169938555500406493238",
"148712175247434912618972778538582910989",
"76680413884311512479037421901697121205",
"287526453045095951918699700981044709900",
"262277563848801098201269989253184728278",
"127102701404963868442844136930958552858"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2020-15852-3816c2e2",
"source": "https://github.com/torvalds/linux/commit/cadfad870154e14f745ec845708bc17d166065f2",
"target": {
"file": "arch/x86/include/asm/io_bitmap.h"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"149921550918727571907189110443842496643",
"16294634606765744740476519747333442670",
"279113980104009553361647971717690076502",
"225849507462775144258958032337569164610",
"190658076037502144011098504408544036372",
"302265099600417677401577768880331274635",
"25233635992272401680648963616499509197",
"73842491061418389751364385796250984518",
"314124580815919915997416684083256132993",
"53874702892124586570622750154909258727",
"172966308511962481184146974309250997591",
"174531503454734574704479596954040640018",
"8305607077955296443434149897321567986",
"67428421651840851170164803453245716109",
"66859524405014599920913116165812984274"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2020-15852-3f1f4e63",
"source": "https://github.com/torvalds/linux/commit/cadfad870154e14f745ec845708bc17d166065f2",
"target": {
"file": "arch/x86/kernel/process.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 511.0,
"function_hash": "218680969284071176858667921728374769154"
},
"signature_type": "Function",
"id": "CVE-2020-15852-863a4c16",
"source": "https://github.com/torvalds/linux/commit/cadfad870154e14f745ec845708bc17d166065f2",
"target": {
"function": "native_tss_update_io_bitmap",
"file": "arch/x86/kernel/process.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"50746706567437524267271875088073571258",
"206358163664779418131489839478801588517",
"86803360504713482117185565600226898114",
"280489078718345262240759496570129439689"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2020-15852-9331bb85",
"source": "https://github.com/torvalds/linux/commit/cadfad870154e14f745ec845708bc17d166065f2",
"target": {
"file": "arch/x86/kernel/paravirt.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"35128875697175228389017966578718690797",
"145989667483504088586280973990949560721",
"320935880624631404944127611246296373162",
"234210654846628432821158081525999095001",
"225682246327555539699063903018837689058",
"274058826386273978746460512746551097457",
"132044136146813834733311191213284975260",
"28873377527141776858116081835056053930"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2020-15852-b20e7576",
"source": "https://github.com/torvalds/linux/commit/cadfad870154e14f745ec845708bc17d166065f2",
"target": {
"file": "arch/x86/xen/enlighten_pv.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 128.0,
"function_hash": "60949817877343863595163044703890291238"
},
"signature_type": "Function",
"id": "CVE-2020-15852-ba1949fb",
"source": "https://github.com/torvalds/linux/commit/cadfad870154e14f745ec845708bc17d166065f2",
"target": {
"function": "switch_to_bitmap",
"file": "arch/x86/kernel/process.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"292377201986124426088374945784002966385",
"82027770061158552329211272843427036891",
"116839325408544462398063348905056937035",
"4664274812866225501410741842704629509"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2020-15852-edfd733e",
"source": "https://github.com/torvalds/linux/commit/cadfad870154e14f745ec845708bc17d166065f2",
"target": {
"file": "arch/x86/include/asm/paravirt.h"
}
},
{
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 113.0,
"function_hash": "313958508051760420177791029351034372385"
},
"signature_type": "Function",
"id": "CVE-2020-15852-f95d22d1",
"source": "https://github.com/torvalds/linux/commit/cadfad870154e14f745ec845708bc17d166065f2",
"target": {
"function": "tss_invalidate_io_bitmap",
"file": "arch/x86/kernel/process.c"
}
}
]