CVE-2020-29486

Name	CVE-2020-29486
Description	An issue was discovered in Xen through 4.14.x. Nodes in xenstore have an ownership. In oxenstored, a owner could give a node away. However, node ownership has quota implications. Any guest can run another guest out of quota, or create an unbounded number of nodes owned by dom0, thus running xenstored out of memory A malicious guest administrator can cause a denial of service against a specific guest or against the whole host. All systems using oxenstored are vulnerable. Building and using oxenstored is the default in the upstream Xen distribution, if the Ocaml compiler is available. Systems using C xenstored are not vulnerable.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-4812-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
xen (PTS)	jessie, jessie (lts)	4.4.4lts5-0+deb8u1	vulnerable
	stretch (security), stretch (lts), stretch	4.8.5.final+shim4.10.4-1+deb9u12	vulnerable
	buster (security), buster, buster (lts)	4.11.4+107-gef32c7afa2-1	fixed
	bullseye	4.14.6-1	fixed
	bullseye (security)	4.14.5+94-ge49571868d-1	fixed
	bookworm	4.17.3+10-g091466ba55-1~deb12u1	fixed
	sid, trixie	4.17.3+36-g54dacb5c02-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin
xen	source	jessie	(unfixed)	end-of-life
xen	source	stretch	(unfixed)	end-of-life
xen	source	buster	4.11.4+57-g41a822c392-2		DSA-4812-1
xen	source	(unstable)	4.14.0+88-g1d1d1f5391-1

[stretch] - xen <end-of-life> (DSA 4602-1)
https://xenbits.xen.org/xsa/advisory-352.html