ISSUE DESCRIPTION
=================
The High Precision Event Timer (HPET) can be configured to deliver
interrupts in one of three different modes - through legacy interrupts;
through the IO-APIC; or optionally via a method similar to PCI MSI. The
last mode is optional and not implemented by Xen. However, of the first
two modes, only the legacy variant was properly implemented.
If a guest set up an HPET timer in IO-APIC mode, Xen would still
handle this using the code for the legacy mode. Unfortunately, the
available IO-APIC mode interrupt numbers are higher than legacy mode
interrupts. The result was array overruns.
IMPACT
======
A malicious or buggy HVM guest may cause a hypervisor crash, resulting
in a Denial of Service (DoS) affecting the entire host. Privilege
escalation, or information leaks, cannot be excluded.
VULNERABLE SYSTEMS
==================
Xen versions 3.1 and later are vulnerable.
Only x86 systems are vulnerable. ARM systems are not vulnerable.
Only x86 HVM guests can exploit the vulnerability. x86 PV and PVH
guests cannot exploit the vulnerability.
Only x86 HVM guests provided with hypervisor-side HPET emulation can
exploit the vulnerability. That is the default configuration. x86
HVM guests whose configuration explicitly disables this emulation (via
"hpet=0") cannot exploit the vulnerability.
MITIGATION
==========
Running only PV or PVH guests avoids the vulnerability.
Not exposing the hypervisor based HPET emulation to HVM guests, by
adding "hpet=0" to the guest configuration, also avoids the
vulnerability.
External References:
http://xenbits.xen.org/xsa/advisory-261.html