WaratekVRT Sign in

CVE-2020-29569 Xen

Affected softwareXen
Severity8.8 High CVSS 3.1 2 scores
WeaknessUse after free (CWE-416)
Published15 Dec 2020
Updated17 Jun 2026

Description

An issue was discovered in the Linux kernel through 5.10.1, as used with Xen through 4.14.x. The Linux kernel PV block backend expects the kernel thread handler to reset ring->xenblkd to NULL when stopped. However, the handler may not have time to run if the frontend quickly toggles between the states connect and disconnect. As a consequence, the block backend may re-use a pointer after it was freed. A misbehaving guest can trigger a dom0 crash by continuously connecting / disconnecting a block frontend. Privilege escalation and information leaks cannot be ruled out. This only affects systems with a Linux blkback.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 5 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC none indexed
  • EPSS 0.40% chance in 30 days

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

8.8 HIGH v3.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 8.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H NVD Primary published
CVSS 2.0 7.2 none AV:L/AC:L/Au:N/C:C/I:C/A:C NVD Primary

Affected software and releases

Products and versions

6 products, 14 version entries
SourceVendorProductSchemeAffected versions
nvd debian debian linux generic 9.0 · 10.0
nvd linux linux kernel generic ≥ 4.1.44 and ＜ 4.2 · ≥ 4.4.80 and ＜ 4.4.254 · ≥ 4.9.36 and ＜ 4.9.249 · ≥ 4.11.9 and ＜ 4.12 · ≥ 4.12 and ＜ 4.14.213 · ≥ 4.15 and ＜ 4.19.164 · ≥ 4.20 and ＜ 5.4.86 · ≥ 5.5 and ＜ 5.10.4
nvd netapp hci compute node bios generic any version
nvd netapp solidfire \& hci management node generic any version
nvd netapp solidfire \& hci storage node generic any version
nvd xen xen generic ≤ 4.14.1

Earlier manual review

A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.

## Manual Classification Context **Products:** XEN

References

URLTags
https://lists.debian.org/debian-lts-announce/2021/02/msg00018.html Mailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/03/msg00010.html Mailing List, Third Party Advisory
https://security.gentoo.org/glsa/202107-30 Third Party Advisory
https://security.netapp.com/advisory/ntap-20210205-0001/ Third Party Advisory
https://www.debian.org/security/2021/dsa-4843 Third Party Advisory
https://xenbits.xenproject.org/xsa/advisory-350.html Patch, Vendor Advisory

Timeline
Published2020-12-15By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.