Igor Druzhinin

The issue is related to inappropriate x86 IOMMU timeout detection and handling. IOMMUs process commands in parallel with the operation of the CPU(s) issuing such commands. In the current implementation in Xen, asynchronous notification of the completion of such commands is not used, and the issuing CPU spin-waits for the completion of the most recently issued command(s). Some of these waiting loops try to apply a timeout to fail overly-slow commands. However, the course of action upon a perceived timeout actually being detected is inappropriate, potentially causing guests to be marked as crashed on Intel hardware or higher layer callers to continue as if the IOMMU operation succeeded on AMD hardware.

A race condition exists when migrating timers between x86 HVM vCPUs, potentially causing a hang or crash of the hypervisor, resulting in a Denial of Service (DoS). The issue is specific to x86 systems and can only be leveraged by x86 HVM guests with more than one vCPU.

The issue allows x86 PV guest OS users to cause a denial of service due to mishandling of failed IOMMU operations, which causes a bug check during the cleanup of a crashed guest. This is a result of insufficient input validation, enabling an attacker to exploit the issue and cause a denial of service.