page transfer may allow PV guest to elevate privilege

ISSUE DESCRIPTION

Domains controlling other domains are permitted to map pages owned by the domain being controlled. If the controlling domain unmaps such a page without flushing the TLB, and if soon after the domain being controlled transfers this page to another PV domain (via GNTTABOP_transfer or, indirectly, XENMEM_exchange), and that third domain uses the page as a page table, the controlling domain will have write access to a live page table until the applicable TLB entry is flushed or evicted. Note that the domain being controlled is necessarily HVM, while the controlling domain is PV.

IMPACT

A malicious pair of guests may be able to access all of system memory, allowing for all of privilege escalation, host crashes, and information leaks.

VULNERABLE SYSTEMS

All Xen versions are vulnerable.
Only x86 systems are affected. ARM systems are not vulnerable.
Only systems where an attacker can control both a PV and an HVM guest are vulnerable. This must be presumed to include systems containing HVM domains with service domains such as stub domain device models.
Systems containing only PV guests are not vulnerable.
Systems containing only HVM domains serviced by dom0 device model processes are not vulnerable. Note that with libxl, xl, and libvirt, HVM domains use dom0 device model processes by default.