CVE-2020-29485: Debian Linux

Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days.

An issue was discovered in Xen 4.6 through 4.14.x. When acting upon a guest XS_RESET_WATCHES request, not all tracking information is freed. A guest can cause unbounded memory usage in oxenstored. This can lead to a system-wide DoS. Only systems using the Ocaml Xenstored implementation are vulnerable. Systems using the C Xenstored implementation are not vulnerable.

Affected products

• Debian Debian Linux: version 10.0 only
• Fedoraproject Fedora: version 32 only; version 33 only
• Xen Xen: from 4.6.0, up to and including 4.14.0

Published 2020-12-15. Last modified 2026-06-17.