Fix for XSA-240 conflicts with shadow paging

2018-11-2012:00:00

Xen Project

xenbits.xen.org

240

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS

0.001

Percentile

26.7%

JSON

ISSUE DESCRIPTION

The fix for XSA-240 introduced a new field into the control structure associated with each page of RAM. This field was added to a union, another member of which is used when Xen uses shadow paging for the guest. During migration, or with the L1TF (XSA-273) mitigation for PV guests in effect, the two uses conflict.

IMPACT

A malicious or buggy x86 PV guest may cause Xen to crash, resulting in a DoS (Denial of Service) affecting the entire host. Privilege escalation as well as information leaks cannot be ruled out.

VULNERABLE SYSTEMS

All Xen versions from at least 3.2 onwards are vulnerable. Earlier versions have not been checked.
Only x86 systems are affected. ARM systems are not affected.
Only Xen versions with the XSA-240 fixes applied are vulnerable.
Only Xen versions which permit linear page table use by PV guests are vulnerable.
Only x86 PV guests can leverage this vulnerability. x86 HVM guests cannot leverage this vulnerability.