ISSUE DESCRIPTION
=================
Guests have the ability to request removal of memory from themselves.
This operation is intended to be requested for normal read/write pages,
but is also permitted to be used on other types of pages. So far this
in particular included pages pinned to their current type, with the
necessary unpinning happening implicitly. The unpinning of higher level
page tables can, however, take a significant amount of time, and hence
is generally expected to be carried out with intermediate preemption
checks. Such checks were missing from the code path involved here.
IMPACT
======
A malicious guest administrator can cause a Denial of Service (DoS).
Specifically, prevent use of a physical CPU for a significant period of
time.
VULNERABLE SYSTEMS
==================
All Xen versions are vulnerable.
Only x86 systems are affected. ARM systems are not affected.
Only PV guests can leverage this vulnerability. HVM guests cannot
leverage this vulnerability.
MITIGATION
==========
Running only HVM guests will avoid this issue.
External References:
http://xenbits.xen.org/xsa/advisory-252.html