Information leak through version information hypercall

ISSUE DESCRIPTION The code handling certain sub-operations of the HYPERVISORxenversion hypercall fails to fully initialize all fields of structures subsequently copied back to guest memory. Due to this hypervisor stack contents are copied into the destination of the operation, thus becoming visib...

insufficient permissions checks accessing guest memory on ARM

ISSUE DESCRIPTION When accessing guest memory Xen does not correctly perform permissions checks on the possibly guest provided virtual address: it only checks that the mapping is readable by the guest, even when writing on behalf of the guest. This allows a guest to write to memory which it shoul...

Memory accessible by 64-bit PV guests under live migration

ISSUE DESCRIPTION On some hardware, during live migration of 64-bit PV guests, some parts of the guest's shadow pagetables are mistakenly filled in with hypervisor mappings. This causes Xen to crash when those mappings are later cleared. Before the crash, a malicious guest could use hypercalls to...

GhostRace: Speculative Race Conditions

ISSUE DESCRIPTION Researchers at VU Amsterdam and IBM Research have discovered GhostRace; an analysis of the behaviour of synchronisation primitives under speculative execution. Synchronisation primitives are typically formed as an unbounded loop which waits until a resource is available to be...

Linux: error handling issues in blkback's grant mapping

ISSUE DESCRIPTION To service requests, the driver maps grant references provided by the frontend. In this process, errors may be encountered. In one case an error encountered earlier might be discarded by later processing, resulting in the caller assuming successful mapping, and hence subsequent...

grant transfer allows PV guest to elevate privileges

ISSUE DESCRIPTION The GNTTABOPtransfer operation allows one guest to transfer a page to another guest. The internal processing of this, however, does not include zapping the previous type of the page being transferred. This makes it possible for a PV guest to transfer a page previously used as pa...

Nested HVM exposes host to being driven out of memory by guest

ISSUE DESCRIPTION Guests are currently permitted to enable nested virtualization on themselves. Missing error handling cleanup in the handling code makes it possible for a guest, particularly a multi-vCPU one, to repeatedly invoke this operation, thus causing a leak of - over time - unbounded...

x86: MMIO Stale Data vulnerabilities

ISSUE DESCRIPTION This issue is related to the SRBDS, TAA and MDS vulnerabilities. Please see: https://xenbits.xen.org/xsa/advisory-320.html SRBDS https://xenbits.xen.org/xsa/advisory-305.html TAA https://xenbits.xen.org/xsa/advisory-297.html MDS Please see Intel's whitepaper:...

Bugs in dynamic height handling for AMD IOMMU pagetables

ISSUE DESCRIPTION When running on AMD systems with an IOMMU, Xen attempted to dynamically adapt the number of levels of pagetables the pagetable height in the IOMMU according to the guest's address space size. The code to select and update the height had several bugs. Notably, the update was done...

I/O port access privilege escalation in x86-64 Linux

ISSUE DESCRIPTION IRET and POPF do not modify EFLAGS.IOPL when executed by code at a privilege level other than zero. Since PV Xen guests run at privilege level 3 for 64-bit ones; 32-bit ones run at privilege level 1, to compensate for this the context switching of EFLAGS.IOPL requires the guest ...

QEMU heap overflow flaw while processing certain ATAPI commands.

ISSUE DESCRIPTION The QEMU security team has predisclosed the following advisory: A heap overflow flaw was found in the way QEMU's IDE subsystem handled I/O buffer access while processing certain ATAPI commands. A privileged guest user in a guest with CDROM drive enabled could potentially use thi...

Heap overflow in QEMU PCNET controller, allowing guest->host escape

ISSUE DESCRIPTION The QEMU security team has predisclosed the following advisory: pcnettransmit loads a transmit-frame descriptor from the guest into the /tmd/ local variable to recover a length field, a status field and a guest-physical location of the associated frame buffer. If the status fiel...

Long latency MMIO mapping operations are not preemptible

ISSUE DESCRIPTION The XENDOMCTLmemorymapping hypercall allows long running operations without implementing preemption. This hypercall is used by the device model as part of the emulation associated with configuration of PCI devices passed through to HVM guests and is therefore indirectly exposed ...

p2m lock starvation

ISSUE DESCRIPTION The current read/write lock implementation is read-biased, which allows a consistent stream of readers to starve writers indefinitely. There are certain rwlocks where guests are capable of applying arbitrary read pressure. IMPACT A malicious guest administrator can deny service ...

once valid event channels may not turn invalid

ISSUE DESCRIPTION Logic in the handling of event channel operations in Xen assumes that an event channel, once valid, will not become invalid over the life time of a guest. However, operations like the resetting of all event channels may involve decreasing one of the bounds checked when determini...

multiple xenoprof issues

ISSUE DESCRIPTION Unprivileged guests can request to map xenoprof buffers, even if profiling has not been enabled for those guests. These buffers were not scrubbed. This is CVE-2020-11740. Furthermore, for guests for which "active" profiling was enabled by the administrator, the xenoprof code use...

x86: CPU lockup during exception delivery

ISSUE DESCRIPTION When a benign exception occurs while delivering another benign exception, it is architecturally specified that these would be delivered sequentially. There are, however, cases where this results in an infinite loop inside the CPU, which in the virtualized case can be broken only...

grant table hypercall acquire/release imbalance

ISSUE DESCRIPTION When releasing a non-v1 non-transitive grant after doing a grant copy operation, Xen incorrectly recurses as if for a transitive grant and releases an unrelated grant reference. IMPACT A malicious guest administrator can cause undefined behaviour; depending on the dom0 kernel a...

Xenstore: guests can let run xenstored out of memory

ISSUE DESCRIPTION Malicious guests can cause xenstored to allocate vast amounts of memory, eventually resulting in a Denial of Service DoS of xenstored. There are multiple ways how guests can cause large memory allocations in xenstored: - - by issuing new requests to xenstored without reading the...

Guest can force Linux netback driver to hog large amounts of kernel memory

ISSUE DESCRIPTION Incoming data packets for a guest in the Linux kernel's netback driver are buffered until the guest is ready to process them. There are some measures taken for avoiding to pile up too much data, but those can be bypassed by the guest: There is a timeout how long the client side ...

Guest triggered use-after-free in Linux xen-netback

ISSUE DESCRIPTION A malicious or buggy network PV frontend can force Linux netback to disable the interface and terminate the receive kernel thread associated with queue 0 in response to the frontend sending a malformed packet. Such kernel thread termination will lead to a use-after-free in Linux...

ocaml xenstored mishandles oversized message replies

ISSUE DESCRIPTION The Ocaml xenstored implementation "oxenstored" cannot correctly handle a message reply larger than XENSTOREPAYLOADSIZE when communicating with a client domain via the shared ring mechanism. When this situation occurs the connection to the client domain will be shutdown and cann...

Several access permission issues with IRQs for unprivileged guests

ISSUE DESCRIPTION Various IRQ related access control operations may not have the intended effect, thus potentially permitting a stub domain to grant its client domain access to an IRQ it doesn't have access to itself. IMPACT Malicious or buggy stub domains kernels can mount a denial of service...

IOMMU: RMRR (VT-d) and unity map (AMD-Vi) handling issues

ISSUE DESCRIPTION Certain PCI devices in a system might be assigned Reserved Memory Regions specified via Reserved Memory Region Reporting, "RMRR" for Intel VT-d or Unity Mapping ranges for AMD-Vi. These are typically used for platform tasks such as legacy USB emulation. Since the precise purpose...

Further issues with restartable PV type change operations

ISSUE DESCRIPTION XSA-299 addressed several critical issues in restartable PV type change operations. Despite extensive testing and auditing, some corner cases were missed. IMPACT A malicious PV guest administrator may be able to escalate their privilege to that of the host. VULNERABLE SYSTEMS Al...

cirrus_bitblt_cputovideo does not check if memory region is safe

ISSUE DESCRIPTION In CIRRUSBLTMODEMEMSYSSRC mode the bitblit copy routine cirrusbitbltcputovideo fails to check wethehr the specified memory region is safe. IMPACT A malicious guest administrator can cause an out of bounds memory write, very likely exploitable as a privilege escalation. VULNERABL...

virtio: unbounded memory allocation issue

ISSUE DESCRIPTION A guest can submit virtio requests without bothering to wait for completion and is therefore not bound by virtqueue size. This requires reusing vring descriptors in more than one request, which is incorrect but possible. Processing a request allocates a VirtQueueElement and...

libxl fails to honour readonly flag on disks with qemu-xen

ISSUE DESCRIPTION Callers of libxl can specify that a disk should be read-only to the guest. However, there is no code in libxl to pass this information to qemu-xen the upstream-based qemu; and indeed there is no way in qemu to make a disk read-only. The vulnerability is exploitable only via...

Lock order reversal between page_alloc_lock and mm_rwlock

ISSUE DESCRIPTION The locks pagealloclock and mmrwlock are not always taken in the same order. This raises the possibility of deadlock. The incorrect order occurs only in the implementation of the deprecated domctl hypercall XENDOMCTLgetmemlist. IMPACT A malicious guest administrator may be able ...

Xen PV DoS vulnerability with SYSENTER

ISSUE DESCRIPTION The SYSENTER instruction can be used by PV guests to accelerate system call processing. This instruction, however, leaves the EFLAGS register mostly unmodified - in particular, the NT flag doesn't get cleared. If the hypervisor subsequently uses IRET to return to the guest which...

Several memory hypercall operations allow invalid extent order values

ISSUE DESCRIPTION Allowing arbitrary extentorder input values for XENMEMdecreasereservation, XENMEMpopulatephysmap, and XENMEMexchange can cause arbitrarily long time being spent in loops without allowing vital other code to get a chance to execute. This may also cause inconsistent state resultin...

x86 shadow paging arbitrary pointer dereference

ISSUE DESCRIPTION In environments where host assisted address translation is necessary but Hardware Assisted Paging HAP is unavailable, Xen will run guests in so called shadow mode. Due to too lax a check in one of the hypervisor routines used for shadow page handling it is possible for a guest...

Unmediated PCI register access in qemu

ISSUE DESCRIPTION Qemu allows guests to not only read, but also write all parts of the PCI config space but not extended config space of passed through PCI devices not explicitly dealt with for partial emulation purposes. IMPACT Since the effect depends on the specific purpose of the the config...

Vulnerabilities in HVM MSI injection

ISSUE DESCRIPTION The implementation of the HVM control operation HVMOPinjectmsi, while checking whether a particular IRQ was already set up in the necessary way, fails to properly check all respective conditions. In particular it doesn't check the returned pointer for being non-NULL before de-...

XENMEM_exchange may overwrite hypervisor memory

ISSUE DESCRIPTION The handler for XENMEMexchange accesses guest memory without range checking the guest provided addresses, thus allowing these accesses to include the hypervisor reserved range. IMPACT A malicious guest administrator can cause Xen to crash. If the out of address space bounds acce...

x86: Speculative vulnerabilities with bare (non-shim) 32-bit PV guests

ISSUE DESCRIPTION 32-bit x86 PV guest kernels run in ring 1. At the time when Xen was developed, this area of the i386 architecture was rarely used, which is why Xen was able to use it to implement paravirtualisation, Xen's novel approach to virtualization. In AMD64, Xen had to use a different...

blkif responses leak backend stack data

ISSUE DESCRIPTION The block interface response structure has some discontiguous fields. Certain backends populate the structure fields of an otherwise uninitialized instance of this structure on their stacks, leaking data through the internal or trailing padding field. IMPACT A malicious...

x86 task switch to VM86 mode mis-handled

ISSUE DESCRIPTION LDTR, just like TR, is purely a protected mode facility. Hence even when switching to a VM86 mode task, LDTR loading needs to follow protected mode semantics. This was violated by the code. IMPACT On SVM AMD hardware: a malicious unprivileged guest process can escalate its...

Information leak via internal x86 system device emulation

ISSUE DESCRIPTION Emulation routines in the hypervisor dealing with certain system devices check whether the access size by the guest is a supported one. When the access size is unsupported these routines failed to set the data to be returned to the guest for read accesses, so that hypervisor sta...

Excessive checking in compatibility mode hypercall argument translation

ISSUE DESCRIPTION The hypercall argument translation needed for 32-bit guests running on 64-bit hypervisors performs checks on the final register state. These checks cover all registers potentially holding hypercall arguments, not just the ones actually doing so for the hypercall being processed,...

Missing privilege level checks in x86 emulation of far branches

ISSUE DESCRIPTION The emulation of far branch instructions CALL, JMP, and RETF in Intel assembly syntax, LCALL, LJMP, and LRET in AT&T assembly syntax incompletely performs privilege checks. However these instructions are not usually handled by the emulator. Exceptions to this are - when a memory...

use-after-free in xc_cpupool_getinfo() under memory pressure

ISSUE DESCRIPTION If xccpumapalloc fails then xccpupoolgetinfo will free and incorrectly return the then-free pointer to the result structure. IMPACT An attacker may be able to cause a multi-threaded toolstack using this function to race against itself leading to heap corruption and a potential...

Grant table version switch list corruption vulnerability

ISSUE DESCRIPTION Downgrading the grant table version of a guest involves freeing its status pages. This freeing was incomplete - the pages are freed back to the allocator, but not removed from the domain's tracking list. This would cause list corruption, eventually leading to a hypervisor crash...

x86: shadow stack vs exceptions from emulation stubs

ISSUE DESCRIPTION Recent x86 CPUs offer functionality named Control-flow Enforcement Technology CET. A sub-feature of this are Shadow Stacks CET-SS. CET-SS is a hardware feature designed to protect against Return Oriented Programming attacks. When enabled, traditional stacks holding both data and...

x86: Cross-Thread Return Address Predictions

ISSUE DESCRIPTION It has been discovered that on some AMD CPUs, the RAS Return Address Stack, also called RAP - Return Address Predictor - in some AMD documentation, and RSB - Return Stack Buffer - in Intel terminology is dynamically partitioned between non-idle threads. This allows an attacker t...

x86: Multiple speculative security issues

ISSUE DESCRIPTION 1 Researchers have discovered that on some AMD CPUs, the implementation of IBPB Indirect Branch Prediction Barrier does not behave according to the specification. Specifically, IBPB fails to properly flush the RAS Return Address Stack, also RSB - Return Stack Buffer - in Intel...

ARM guests may induce host asynchronous abort

ISSUE DESCRIPTION Depending on how the hardware and firmware have been integrated, guest-triggered asynchronous aborts SError on ARMv8 may be received by the hypervisor. The current action is to crash the host. A guest might trigger an asynchronous abort when accessing memory mapped hardware in a...

arm: Host crash when preempting a multicall

ISSUE DESCRIPTION Early versions of Xen on ARM did not support "multicall" functionality the ability to perform multiple operations via a single hypercall and therefore stubbed out the functionality needed to support preemption of multicalls in a manner which crashed the host. When multicall...

guest 32-bit ELF symbol table load leaking host data

ISSUE DESCRIPTION Along with their main kernel binary, unprivileged guests may arrange to have their Xen environment load kernel symbol tables for their use. The ELF image metadata created for this purpose has a few unused bytes when the symbol table binary is in 32-bit ELF format. These unused...

qemu-dm buffer overrun in MSI-X handling

ISSUE DESCRIPTION "qemu-xen-traditional" aka qemu-dm tracks state for each MSI-X table entry of a passed through device. This is used/updated on intercepted accesses to the pages containing the MSI-X table. There may be space on the final page not covered by any MSI-X table entry, but memory for...