Unmediated PCI register access in qemu

ISSUE DESCRIPTION

Qemu allows guests to not only read, but also write all parts of the PCI config space (but not extended config space) of passed through PCI devices not explicitly dealt with for (partial) emulation purposes.

IMPACT

Since the effect depends on the specific purpose of the the config space field, it’s not possbile to give a general statement about the exact impact on the host or other guests. Privilege escalation, host crash (Denial of Service), and leaked information all cannot be excluded.

VULNERABLE SYSTEMS

Xen versions 3.3 and onwards are vulnerable due to supporting PCI pass-through.
Only x86 systems are vulnerable. ARM systems are not vulnerable.
Only HVM guests with their device model run in Dom0 can take advantage of this vulnerability.
Only HVM guests which have been granted access to physical PCI devices (`PCI passthrough’) can take advantage of this vulnerability.