CVE-2020-25596: 
NixOS vulnerability analysis and mitigation

An issue was discovered in Xen through 4.14.x affecting x86 PV guest kernels that can experience denial of service via SYSENTER. The vulnerability (CVE-2020-25596) was discovered by Andrew Cooper of Citrix and publicly disclosed on September 22, 2020. The issue affects all versions of Xen from 3.2 onwards on x86 systems that support the SYSENTER instruction in 64bit mode, specifically Intel, Centaur, and Shanghai CPUs, while AMD and Hygon CPUs are not believed to be vulnerable (Xen Advisory).

The vulnerability stems from the SYSENTER instruction's state sanitization activities being left to software. One of Xen's sanitization paths injects a #GP fault and incorrectly delivers it twice to the guest. This causes the guest kernel to observe a kernel-privilege #GP fault (typically fatal) rather than a user-privilege #GP fault (which would usually be converted into SIGSEGV/etc). The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability allows malicious or buggy userspace to crash the guest kernel, resulting in a VM Denial of Service. Only x86 PV guests can exploit the vulnerability, while x86 PVH / HVM guests are not affected (Xen Advisory).

The vulnerability requires local access and can be exploited by x86 PV guest users. The vulnerability is specifically exploitable on systems running Intel, Centaur, and Shanghai CPUs that support the SYSENTER instruction in 64bit mode (Xen Advisory).

The primary mitigation is running only x86 PVH / HVM guests to avoid the vulnerability. Various Linux distributions have released patches to address this vulnerability, including Ubuntu 20.04 LTS (version 4.11.3+24-g14b62ab3e5-1ubuntu2.3), Fedora 31-33, and openSUSE Leap 15.2 (Ubuntu Notice, OpenSUSE Advisory).