Bug 1544456 (CVE-2018-7540, xsa252) - CVE-2018-7540 xsa252 xen: DoS via non-preemptable L3/L4 pagetable freeing (XSA-252)
Summary: CVE-2018-7540 xsa252 xen: DoS via non-preemptable L3/L4 pagetable freeing (XS...
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2018-7540, xsa252
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1549568
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-02-12 14:38 UTC by Adam Mariš
Modified: 2021-02-17 00:50 UTC (History)
13 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-06-08 03:39:39 UTC
Embargoed:


Attachments (Terms of Use)

Description Adam Mariš 2018-02-12 14:38:36 UTC
ISSUE DESCRIPTION
=================

Guests have the ability to request removal of memory from themselves.
This operation is intended to be requested for normal read/write pages,
but is also permitted to be used on other types of pages.  So far this
in particular included pages pinned to their current type, with the
necessary unpinning happening implicitly.  The unpinning of higher level
page tables can, however, take a significant amount of time, and hence
is generally expected to be carried out with intermediate preemption
checks.  Such checks were missing from the code path involved here.

IMPACT
======

A malicious guest administrator can cause a Denial of Service (DoS).
Specifically, prevent use of a physical CPU for a significant period of
time.

VULNERABLE SYSTEMS
==================

All Xen versions are vulnerable.

Only x86 systems are affected.  ARM systems are not affected.

Only PV guests can leverage this vulnerability.  HVM guests cannot
leverage this vulnerability.

MITIGATION
==========

Running only HVM guests will avoid this issue.

External References:

http://xenbits.xen.org/xsa/advisory-252.html

Comment 2 Adam Mariš 2018-02-27 12:35:31 UTC
Acknowledgments:

Name: the Xen project
Upstream: Jann Horn (Google)

Comment 3 Adam Mariš 2018-02-27 12:36:42 UTC
Created xen tracking bugs for this issue:

Affects: fedora-all [bug 1549568]


Note You need to log in before you can comment on or make changes to this bug.