Sander Eikelenboom

**Name of the Vulnerable Software and Affected Versions** Xen versions prior to 4.13 **Description** An issue in Xen allows x86 AMD HVM guest OS users to cause a denial of service or possibly gain privileges by triggering data-structure access during pagetable-height updates. The vulnerability is related to the dynamic adaptation of the number of levels of pagetables in the IOMMU according to the guest's address space size. A malicious guest administrator can cause Xen to access data structures while they are being modified, causing Xen to crash. Privilege escalation is thought to be very difficult but cannot be ruled out. Additionally, there is a potential memory leak of 4kb per guest boot, under memory pressure. The vulnerability can be exploited when guests are given direct access to physical devices, and only HVM guests can exploit the vulnerability. **Recommendations** For Xen versions prior to 4.13, update to a version that includes the necessary patches to fix the issue. As a temporary workaround, consider disabling PCI pass-through to minimize the risk of exploitation. Restrict access to physical devices for HVM guests until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Xen versions 4.5.x and earlier **Description** The issue allows local guest users to obtain access to the VGA console. This can be achieved by setting the DISPLAY environment variable when compiled with SDL support, or by connecting to the VNC server on ::1 or 127.0.0.1 when not compiled with SDL support. **Recommendations** For Xen versions 4.5.x and earlier, consider disabling the VGA console emulation for x86 HVM guests as a temporary workaround until a patch is available. Restrict access to the VNC server to minimize the risk of exploitation. Avoid using the DISPLAY environment variable in affected configurations until the issue is resolved.