Skip to content
Fencer Vulns
high 8.8

CVE-2020-29569 json

An issue was discovered in the Linux kernel through 5.10.1, as used with Xen through 4.14.x.

published 2020-12-15 5 y ago modified 2026-06-17 4 mo ago also EUVD-2020-21931

cvss
8.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 34%
public exploits
0
none known

Summary

An issue was discovered in the Linux kernel through 5.10.1, as used with Xen through 4.14.x. The Linux kernel PV block backend expects the kernel thread handler to reset ring->xenblkd to NULL when stopped. However, the handler may not have time to run if the frontend quickly toggles between the states connect and disconnect. As a consequence, the block backend may re-use a pointer after it was freed. A misbehaving guest can trigger a dom0 crash by continuously connecting / disconnecting a block frontend. Privilege escalation and information leaks cannot be ruled out. This only affects systems with a Linux blkback.

Patch / fix

  • linux linux_kernel 4.2, 4.4.254, 4.9.249, 4.12, 4.14.213, 4.19.164, 5.4.86, 5.10.4
  • linux Debian 14, Debian 13, Debian 12 5.9.15-1

debian advisories DEBIAN-CVE-2020-29569

  • linux Ubuntu 16.04 LTS 4.4.0-204.236
  • linux Ubuntu 18.04 LTS 4.15.0-136.140
  • linux Ubuntu 20.04 LTS 5.4.0-66.74
  • linux-aws Ubuntu 16.04 LTS 4.4.0-1123.137
  • linux-aws Ubuntu 18.04 LTS 4.15.0-1094.101
  • linux-aws Ubuntu 20.04 LTS 5.4.0-1038.40
  • linux-gcp Ubuntu 16.04 LTS 4.15.0-1093.106~16.04.1
  • linux-gcp Ubuntu 20.04 LTS 5.4.0-1037.40

ubuntu advisories UBUNTU-CVE-2020-29569

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel-syms SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLES 15 SP1-BCL +6 more 4.12.14-197.83.1
  • kernel-source SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLES 15 SP1-BCL +6 more 4.12.14-197.83.1
  • kernel-default SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLES 15 SP1-BCL +8 more 4.12.14-197.83.1
  • kernel-zfcpdump SLES 15 SP1-LTSS, Manager Server 4.0 4.12.14-197.83.1
  • kernel-obs-build SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLES 15 SP1-BCL +6 more 4.12.14-197.83.1
  • kernel-syms SLES for SAP 12 SP3, SLES 12 SP3-LTSS, SLES 12 SP3-BCL +4 more 4.4.180-94.138.1
  • kernel-source SLES for SAP 12 SP3, SLES 12 SP3-LTSS, SLES 12 SP3-BCL +4 more 4.4.180-94.138.1
  • kernel-default SLES for SAP 12 SP3, SLES 12 SP3-LTSS, SLES 12 SP3-BCL +5 more 4.4.180-94.138.1

suse advisories SUSE-SU-2021:0532-1SUSE-SU-2021:0452-1SUSE-SU-2021:0438-1SUSE-SU-2021:0437-1SUSE-SU-2021:0434-1SUSE-SU-2021:0433-1

  • kernel-syms openSUSE Leap 15.2 5.3.18-lp152.63.1
  • kernel-obs-qa openSUSE Leap 15.2 5.3.18-lp152.63.1
  • kernel-source openSUSE Leap 15.2 5.3.18-lp152.63.1
  • kernel-default openSUSE Leap 15.2 5.3.18-lp152.63.1
  • kernel-preempt openSUSE Leap 15.2 5.3.18-lp152.63.1
  • kernel-kvmsmall openSUSE Leap 15.2 5.3.18-lp152.63.1
  • kernel-obs-build openSUSE Leap 15.2 5.3.18-lp152.63.1
  • kernel-default-base openSUSE Leap 15.2 5.3.18-lp152.63.1.lp152.8.21.1

opensuse advisories openSUSE-SU-2021:0241-1openSUSE-SU-2021:0075-1

  • linux-lts Alpine 3.23, Alpine 3.22, Alpine 3.21 +8 more 5.10.4-r0

alpine advisories ALPINE-CVE-2020-29569

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-29569 updated cvss 6.7

xen: Use after free triggered by block frontend in Linux blkback (XSA-350)

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.40% chance of exploitation in the next 30 days, higher than 34% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD 2.0 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.