ISSUE DESCRIPTION ================= x86 PV guests are permitted to set up certain forms of what is often called "linear page tables", where pagetables contain references to other pagetables at the same level or higher. Certain restrictions apply in order to fit into Xen's page type handling system. An important restriction was missed, however: Stacking multiple layers of page tables of the same level on top of one another is not very useful, and the tearing down of such an arrangement involves recursion. With sufficiently many layers such recursion will result in a stack overflow, commonly resulting in Xen to crash. IMPACT ====== A malicious or buggy PV guest may cause the hypervisor to crash, resulting in Denial of Service (DoS) affecting the entire host. Privilege escalation and information leaks cannot be excluded. VULNERABLE SYSTEMS ================== All Xen versions from at least 3.2 onwards are vulnerable. Earlier versions have not been checked. Only x86 systems are affected. ARM systems are not affected. Only x86 PV guests can leverage the vulnerability. x86 HVM guests cannot leverage the vulnerability. MITIGATION ========== Running only HVM guests will avoid this vulnerability. For PV guests, the vulnerability can be avoided if the guest kernel is controlled by the host rather than guest administrator, provided that further steps are taken to prevent the guest administrator from loading code into the kernel (e.g. by disabling loadable modules etc) or from using other mechanisms which allow them to run code at kernel privilege. External References: http://xenbits.xen.org/xsa/advisory-240.html
Created xen tracking bugs for this issue: Affects: fedora-all [bug 1501391]
Acknowledgments: Name: the Xen project Upstream: Jann Horn (Google)