Downgrading the grant table version of a guest involves freeing its
status pages. This freeing was incomplete - the page(s) are freed back
to the allocator, but not removed from the domain's tracking
list. This would cause list corruption, eventually leading to a
hypervisor crash.
A malicious guest administrator can cause Xen to crash, leading to a
denial of service attack.
Acknowledgements:
Red Hat would like to thank the Xen project for reporting this issue.
Statement:
Not vulnerable.
This issue did not affect the versions of the kernel-xen package as shipped with Red Hat Enterprise Linux 5.
This issue did not affect Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG as we did not have support for Xen hypervisor.
Downgrading the grant table version of a guest involves freeing its status pages. This freeing was incomplete - the page(s) are freed back to the allocator, but not removed from the domain's tracking list. This would cause list corruption, eventually leading to a hypervisor crash. A malicious guest administrator can cause Xen to crash, leading to a denial of service attack. Acknowledgements: Red Hat would like to thank the Xen project for reporting this issue.