| Name | CVE-2020-28368 |
| Description | Xen through 4.14.x allows guest OS administrators to obtain sensitive information (such as AES keys from outside the guest) via a side-channel attack on a power/energy monitoring interface, aka a "Platypus" attack. NOTE: there is only one logically independent fix: to change the access control for each such interface in Xen. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DSA-4804-1 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| xen (PTS) | bullseye | 4.14.6-1 | fixed |
| bullseye (security) | 4.14.5+94-ge49571868d-1 | fixed | |
| bookworm | 4.17.5+23-ga4e5191dc0-1+deb12u1 | fixed | |
| bookworm (security) | 4.17.5+23-ga4e5191dc0-1 | fixed | |
| sid, trixie | 4.20.0-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| xen | source | stretch | (unfixed) | end-of-life | ||
| xen | source | buster | 4.11.4+57-g41a822c392-1 | DSA-4804-1 | ||
| xen | source | (unstable) | 4.14.0+80-gd101b417b7-1 |
[stretch] - xen <end-of-life> (DSA 4602-1)
https://xenbits.xen.org/xsa/advisory-351.html