ISSUE DESCRIPTION
=================
Code to handle copy operations on transitive grants has built in retry
logic, involving a function reinvoking itself with unchanged
parameters. Such use assumes that the compiler would also translate
this to a so called "tail call" when generating machine code.
Empirically, this is not commonly the case, allowing for theoretically
unbounded nesting of such function calls.
IMPACT
======
A malicious or buggy guest may be able to crash Xen. Privilege
escalation and information leaks cannot be ruled out.
VULNERABLE SYSTEMS
==================
All versions of Xen are vulnerable.
MITIGATION
==========
There is no known mitigation.
External References:
http://xenbits.xen.org/xsa/advisory-226.html