-----BEGIN PGP SIGNED MESSAGE-----
Xen Security Advisory CVE-2022-23033 / XSA-393
arm: guest_physmap_remove_page not removing the p2m mappings
UPDATES IN VERSION 2
The functions to remove one or more entries from a guest p2m pagetable
on Arm (p2m_remove_mapping, guest_physmap_remove_page, and p2m_set_entry
with mfn set to INVALID_MFN) do not actually clear the pagetable entry
if the entry doesn't have the valid bit set. It is possible to have a
valid pagetable entry without the valid bit set when a guest operating
system uses set/way cache maintenance instructions. For instance, a
guest issuing a set/way cache maintenance instruction, then calling the
XENMEM_decrease_reservation hypercall to give back memory pages to Xen,
might be able to retain access to those pages even after Xen started
reusing them for other purposes.
A malicious guest may be able to access Xen and other domains' memory.
This could cause information leaks, host or domain Denial of Service
(DoS), and privilege escalations.
Xen version 4.12 and newer are vulnerable. Only Arm systems are
x86 systems are not vulnerable.
There is no known mitigation.
This issue was discovered by Dmytro Firsov of EPAM.
Applying the appropriate attached patch resolves this issue.
Note that patches for released versions are generally prepared to
apply to the stable branches, and may not apply cleanly to the most
recent release tarball. Downstreams are encouraged to update to the
tip of the stable branch before applying these patches.
xsa393.patch xen-unstable - Xen 4.12.x
$ sha256sum xsa393*
DEPLOYMENT DURING EMBARGO
Deployment of the patches and/or mitigations described above (or
others which are substantially similar) is permitted during the
embargo, even on public-facing systems with untrusted guest users and
But: Distribution of updated software is prohibited (except to other
members of the predisclosure list).
Predisclosure list members who wish to deploy significantly different
patches and/or mitigations, please contact the Xen Project Security
(Note: this during-embargo deployment notice is retained in
post-embargo publicly released Xen Project advisories, even though it
is then no longer applicable. This is to enable the community to have
oversight of the Xen Project Security Team's decisionmaking.)
For more information about permissible uses of embargoed information,
consult the Xen Project community's agreed Security Policy:
-----BEGIN PGP SIGNATURE-----
-----END PGP SIGNATURE-----
Created xen tracking bugs for this issue:
Affects: fedora-all [bug 2045044]
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):