find_next_bit() issues

ISSUE DESCRIPTION

In a number of places bitmaps are being used by the hypervisor to track certain state. Iteration over all bits involves functions which may misbehave in certain corner cases:

• On 32-bit Arm accesses to bitmaps with bit a count which is a multiple of 32, an out of bounds access may occur. (CVE-2019-19581)
• On x86 accesses to bitmaps with a compile time known size of 64 may incur undefined behavior, which may in particular result in infinite loops. (CVE-2019-19582)

IMPACT

A malicious guest may cause a hypervisor crash or hang, resulting in a Denial of Service (DoS).

VULNERABLE SYSTEMS

All versions of Xen are vulnerable.
32-bit Arm systems are vulnerable.
x86 systems with 64 or more nodes are vulnerable. We are unaware of any such systems that Xen would run on.
64-bit Arm systems as well as x86 systems with less than 64 nodes are not vulnerable.