Grant table version switch list corruption vulnerability

ISSUE DESCRIPTION

Downgrading the grant table version of a guest involves freeing its status pages. This freeing was incomplete - the page(s) are freed back to the allocator, but not removed from the domain’s tracking list. This would cause list corruption, eventually leading to a hypervisor crash.

IMPACT

A malicious guest administrator can cause Xen to crash, leading to a denial of service attack.

VULNERABLE SYSTEMS

All Xen version from 4.0 on are vulnerable.
Version 3.4 and earlier are not vulnerable.