George Dunlap

يُستخدم عزل جدول صفحات Xen (XPTI) للتخفيف من ثغرة Meltdown عن طريق نسخ إدخالات جدول صفحات الضيف PV ذات 64 بت من جداول صفحات الجذر التي يختارها الضيف إلى الجدول الذي يختاره Xen والذي يستخدمه الجهاز فعلياً. يتم استخدام directmap لقراءة جدول صفحات جذر الضيف. ومع ذلك، قد يكون لدى ضيوف PV directmap لا يغطي جميع الذاكرة، وتحديداً عندما تمتد الذاكرة إلى ما بعد حدود العنوان 5 TiB (أو 3.5 TiB في حال تفعيل CONFIG BIGMEM=y).

The issue is related to a flaw in restartable PV type change operations, which can be exploited by a remote attacker to gain access to confidential data, compromise its integrity, and cause a denial of service. Specifically, the problem lies in the handling of pagetable promotion and demotion operations, where race conditions can be leveraged by x86 PV guest OS users to gain host OS privileges. Xen's use of a type system to track page usage and prevent direct modification of hardware pagetables by guests is compromised by the complexity of making recursive pagetable promotion and demotion operations restartable, leading to potential races that can cause Xen to drop or retain extra type counts. This could allow malicious PV guest administrators to escalate their privileges to that of the host. All x86 systems with untrusted PV guests are vulnerable.

The issue is related to the mishandling of Populate on Demand (PoD) Physical-to-Machine (P2M) errors, allowing HVM guest OS users to gain privileges on the host OS, obtain sensitive information, or cause a denial of service. It is also described as a use-after-free vulnerability in the Xen hypervisor.

The issue allows local x86 guest OS users to modify arbitrary memory, obtain sensitive information, cause a denial of service (host crash), or execute arbitrary code on the host. This is due to broken emulation of bit test instructions when Xen runs on a 64-bit hypervisor. The vulnerability can be exploited by leveraging insufficient input validation.

The issue is related to the libxl toolstack library in Xen, which does not properly release mappings of files used as kernels and initial ramdisks when managing multiple domains in the same process. This allows attackers to cause a denial of service by consuming memory and disk space through starting domains.

The issue allows local HVM guest domains to gain privileges or cause a denial of service via a DMA instruction when IOMMU is disabled. This occurs because the xenlight library provides access to a busmastering-capable PCI passthrough device before the IOMMU setup is complete.