memory leak when destroying guest without PT devices

2017-02-15T12:00:00
ID XSA-207
Type xen
Reporter Xen Project
Modified 2017-02-15T12:05:00

Description

ISSUE DESCRIPTION

Certain internal state is set up, during domain construction, in preparation for possible pass-through device assignment. On ARM and AMD V-i hardware this setup includes memory allocation. On guest teardown, cleanup was erroneously only performed when the guest actually had a pass-through device assigned.

IMPACT

A malicious guest may, by frequently rebooting over extended periods of time, run the system out of memory, resulting in a Denial of Service (DoS). The leak is no more than 4kbytes per guest boot.

VULNERABLE SYSTEMS

Xen versions 3.3 and later are affected. ARM systems, and x86 AMD systems, are affected. Intel systems, and systems without IOMMU/SMMU hardware, are unaffected. All guest kinds can exploit this vulnerability.