CVE-2020-25595: 
NixOS vulnerability analysis and mitigation

An issue was discovered in Xen through 4.14.x affecting PCI passthrough code. The vulnerability (CVE-2020-25595) was discovered by Andrew Cooper of Citrix and publicly disclosed on September 22, 2020. The issue affects all versions of Xen supporting PCI passthrough on x86 systems, while ARM systems are not vulnerable. The vulnerability stems from code paths in Xen's MSI handling that act on unsanitized values read back from device hardware registers (Xen Advisory).

The vulnerability occurs when MSI handling code processes unsanitized values read from device hardware registers. While devices strictly compliant with PCI specifications shouldn't be able to affect these registers, many devices have out-of-spec "backdoor" operations that can influence these reads. The issue has been assigned a CVSS v3.1 Base Score of 6.5 with vector AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H, indicating local access requirements with low complexity (NVD).

A malicious guest with access to passed-through PCI devices may be able to crash Xen, resulting in a Denial of Service (DoS) affecting the entire system. Additionally, privilege escalation and information leaks cannot be excluded from the potential impacts. The vulnerability is particularly concerning for systems passing through devices with out-of-spec functionality, which is noted to be common (Xen Advisory).

The vulnerability can only be exploited by guests with passed-through PCI devices. The Xen Security Team emphasizes that PCI Device Passthrough is generally not safe to use with completely untrusted guests due to hardware limitations. This limitation affects any operating system or hypervisor. The feature is primarily intended for use in removing drivers and backends from domain 0 (Driver Domains) (Xen Advisory).

The primary mitigation is to avoid passing through physical devices to untrusted guests. For affected systems, patches were released to address the vulnerability. Various Linux distributions including Debian, Fedora, and openSUSE have released security updates to address this issue (Debian Advisory, OpenSUSE Advisory).

Multiple major Linux distributions responded promptly to the vulnerability by releasing security updates. AWS acknowledged the vulnerability but confirmed that Nitro-based instances were not affected, and no customer action was required (AWS Security Bulletin).