The HVMOP_set_mem_access operation handler uses an input as an array index before range checking it.

A malicious HVM guest administrator can cause Xen to crash.  If the out of array bounds access does not crash, the arbitrary value read will be used if the caller reads back the default access through the HVMOP_get_mem_access operation, thus causing an information leak. The caller cannot, however, directly control the address from which to read, since the value read in the first step will be used as an array index again in the second step. 


Acknowledgements:

Red Hat would like to thank the Xen project for reporting this issue.