The implementation in Xen of the HVMOP_set_mem_type HVM control
operations attempts to exclude transitioning a page from an
inappropriate memory type. However, only an inadequate subset of
memory types is excluded.
There are certain other types that don't correspond to a particular
valid page, whose page table translation can be inappropriately
changed (by HVMOP_set_mem_type) from not-present (due to the lack of
valid memory page) to present. If this occurs, an invalid translation
will be established.
A malicious administrator of a domain privileged with regard to an
HVM guest can cause Xen to crash leading to a Denial of Service.
Arbitrary code execution, and therefore privilege escalation, cannot
be entirely excluded: On a system with a RAM page present immediately
below the 52-bit address boundary, this would be possible. However,
we are not aware of any systems with such a memory layout.
Red Hat would like to thank the Xen project for reporting this issue.
This issue did not affect the versions of the kernel-xen package as shipped with Red Hat Enterprise Linux 5.
Created xen tracking bugs for this issue:
Affects: fedora-all [bug 1093315]