George Dunlap

Xen Page Table Isolation (XPTI) is used to mitigate Meltdown by copying 64-bit PV guest page table entries from guest-chosen root page tables to the Xen-chosen one used by hardware. The directmap is utilized to read the guest root page table. However, PV guests may have a directmap that does not cover all memory, specifically when memory extends beyond the 5 TiB (or 3.5 TiB if CONFIG BIGMEM=y) address boundary.

The issue is related to a flaw in restartable PV type change operations, which can be exploited by a remote attacker to gain access to confidential data, compromise its integrity, and cause a denial of service. Specifically, the problem lies in the handling of pagetable promotion and demotion operations, where race conditions can be leveraged by x86 PV guest OS users to gain host OS privileges. Xen's use of a type system to track page usage and prevent direct modification of hardware pagetables by guests is compromised by the complexity of making recursive pagetable promotion and demotion operations restartable, leading to potential races that can cause Xen to drop or retain extra type counts. This could allow malicious PV guest administrators to escalate their privileges to that of the host. All x86 systems with untrusted PV guests are vulnerable.

The issue is related to the mishandling of Populate on Demand (PoD) Physical-to-Machine (P2M) errors, allowing HVM guest OS users to gain privileges on the host OS, obtain sensitive information, or cause a denial of service. It is also described as a use-after-free vulnerability in the Xen hypervisor.

The issue allows local x86 guest OS users to modify arbitrary memory, obtain sensitive information, cause a denial of service (host crash), or execute arbitrary code on the host. This is due to broken emulation of bit test instructions when Xen runs on a 64-bit hypervisor. The vulnerability can be exploited by leveraging insufficient input validation.

The issue is related to the libxl toolstack library in Xen, which does not properly release mappings of files used as kernels and initial ramdisks when managing multiple domains in the same process. This allows attackers to cause a denial of service by consuming memory and disk space through starting domains.

The issue allows local HVM guest domains to gain privileges or cause a denial of service via a DMA instruction when IOMMU is disabled. This occurs because the xenlight library provides access to a busmastering-capable PCI passthrough device before the IOMMU setup is complete.