Missing privilege level checks in x86 emulation of software interrupts

ISSUE DESCRIPTION

The emulation of instructions which generate software interrupts fails to perform supervisor mode permission checks.
However these instructions are not usually handled by the emulator. Exceptions to this are

• when a memory operand (implicit for the affected instructions) lives in (emulated or passed through) memory mapped IO space,
• in the case of guests running in 32-bit PAE mode, when such an instruction is (in execution flow) within four instructions of one doing a page table update,
• when an Invalid Opcode exception gets raised by a guest instruction, and the guest then (likely maliciously) alters the instruction to become one of the affected ones,
• when the guest is in real mode (in which case there are no privilege checks anyway).

IMPACT

Malicious HVM guest user mode code may be able to crash the guest.

VULNERABLE SYSTEMS

Xen versions from 3.3 onwards are vulnerable.
Only user processes in HVM guests can take advantage of this vulnerability.