CVE-2020-25601

An issue was discovered in Xen through 4.14.x. There is a lack of preemption in evtchn_reset() / evtchn_destroy(). In particular, the FIFO event channel model allows guests to have a large number of event channels active at a time. Closing all of these (when resetting all event channels or when cleaning up after the guest) may take extended periods of time. So far, there was no arrangement for preemption at suitable intervals, allowing a CPU to spend an almost unbounded amount of time in the processing of these operations. Malicious or buggy guest kernels can mount a Denial of Service (DoS) attack affecting the entire system. All Xen versions are vulnerable in principle. Whether versions 4.3 and older are vulnerable depends on underlying hardware characteristics.

• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00008.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4JRXMKEMQRQYWYEPHVBIWUEAVQ3LU4FN/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DA633Y3G5KX7MKRN4PFEGM3IVTJMBEOM/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RJZERRBJN6E6STDCHT4JHP4MI6TKBCJE/
• https://security.gentoo.org/glsa/202011-06Third Party Advisory
• https://www.debian.org/security/2020/dsa-4769Third Party Advisory
• https://xenbits.xen.org/xsa/advisory-344.htmlVendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00008.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4JRXMKEMQRQYWYEPHVBIWUEAVQ3LU4FN/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DA633Y3G5KX7MKRN4PFEGM3IVTJMBEOM/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RJZERRBJN6E6STDCHT4JHP4MI6TKBCJE/
• https://security.gentoo.org/glsa/202011-06Third Party Advisory
• https://www.debian.org/security/2020/dsa-4769Third Party Advisory
• https://xenbits.xen.org/xsa/advisory-344.htmlVendor Advisory

Published

Sep 23, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-25596An issue was discovered in Xen through 4.14.x. x86 PV guest …5.5
• CVE-2020-25597An issue was discovered in Xen through 4.14.x. There is mish…6.5
• CVE-2020-25598An issue was discovered in Xen 4.14.x. There is a missing un…5.5
• CVE-2020-25599An issue was discovered in Xen through 4.14.x. There are evt…7
• CVE-2020-2560Vulnerability in the Siebel UI Framework product of Oracle S…4.7
• CVE-2020-25600An issue was discovered in Xen through 4.14.x. Out of bounds…5.5
• CVE-2020-25602An issue was discovered in Xen through 4.14.x. An x86 PV gue…6
• CVE-2020-25603An issue was discovered in Xen through 4.14.x. There are mis…7.8
• CVE-2020-25604An issue was discovered in Xen through 4.14.x. There is a ra…4.7
• CVE-2020-25605Cleartext transmission of sensitive information in Agora Vid…5.9
• CVE-2020-25606The AWV component of Mitel MiCollab before 9.2 could allow a…6.1
• CVE-2020-25608The SAS portal of Mitel MiCollab before 9.2 could allow an a…7.2