George Dunlap

O Xen Page Table Isolation (XPTI) é utilizado para mitigar o Meltdown, copiando entradas de tabela de página de convidado PV de 64 bits das tabelas de página raiz escolhidas pelo convidado para a escolhida pelo Xen, que é a utilizada pelo hardware. O directmap é utilizado para ler a tabela de página raiz do convidado. No entanto, convidados PV podem ter um directmap que não cobre toda a memória, especificamente quando a memória se estende além do limite de endereço de 5 TiB (ou 3,5 TiB se CONFIG BIGMEM=y).

The issue is related to a flaw in restartable PV type change operations, which can be exploited by a remote attacker to gain access to confidential data, compromise its integrity, and cause a denial of service. Specifically, the problem lies in the handling of pagetable promotion and demotion operations, where race conditions can be leveraged by x86 PV guest OS users to gain host OS privileges. Xen's use of a type system to track page usage and prevent direct modification of hardware pagetables by guests is compromised by the complexity of making recursive pagetable promotion and demotion operations restartable, leading to potential races that can cause Xen to drop or retain extra type counts. This could allow malicious PV guest administrators to escalate their privileges to that of the host. All x86 systems with untrusted PV guests are vulnerable.

The issue is related to the mishandling of Populate on Demand (PoD) Physical-to-Machine (P2M) errors, allowing HVM guest OS users to gain privileges on the host OS, obtain sensitive information, or cause a denial of service. It is also described as a use-after-free vulnerability in the Xen hypervisor.

The issue allows local x86 guest OS users to modify arbitrary memory, obtain sensitive information, cause a denial of service (host crash), or execute arbitrary code on the host. This is due to broken emulation of bit test instructions when Xen runs on a 64-bit hypervisor. The vulnerability can be exploited by leveraging insufficient input validation.

The issue is related to the libxl toolstack library in Xen, which does not properly release mappings of files used as kernels and initial ramdisks when managing multiple domains in the same process. This allows attackers to cause a denial of service by consuming memory and disk space through starting domains.

The issue allows local HVM guest domains to gain privileges or cause a denial of service via a DMA instruction when IOMMU is disabled. This occurs because the xenlight library provides access to a busmastering-capable PCI passthrough device before the IOMMU setup is complete.