Teddy Astie

A synchronization issue exists where vNUMA (virtual Non-Uniform Memory Access) configuration data of a guest remains accessible even after domain destruction has begun. This occurs because the cleanup of the configuration information is not synchronized with its retrieval by the device model controlling the guest.

The `varstored` component of the Xapi toolstack, which manages UEFI Variables for virtual machines, contains insufficient compiler barriers. This leads to Time-of-Check to Time-of-Use (TOCTOU) issues—a race condition where data is modified between the time it is checked and the time it is used—within a shared buffer used for communication with OVMF inside the VM. Depending on the compiler settings, an attacker may be able to control an index used in a jump table.

Certain Viridian hypercalls can be specified in a way that leads to a security issue. Details are available in a linked source.

Certain hypercalls within xen can be specified in a manner that presents a security concern. The description does not provide details about the nature of the issue or any specific technical details regarding exploitation, such as API endpoints or vulnerable parameters. There is no information about the number of potentially affected devices or any real-world incidents where this issue has been exploited.

The issue is related to flawed error handling in the logic establishing mappings for Reserved Memory Regions (RMRR) in Intel VT-d or Unity Mapping ranges for AMD-Vi. This flaw can result in mappings remaining in place when they should have been removed, allowing respective guests to gain access to memory regions they are not supposed to have access to. The precise purpose of these regions is unknown, and they are typically used for platform tasks such as legacy USB emulation.

The issue is related to the incorrect placement of a preprocessor directive in the source code, which results in logic that doesn't operate as intended when support for HVM guests is compiled out of Xen. This can potentially allow an attacker to elevate privileges.