alloc_heap_pages allows callers to specify the first NUMA node that should be used for allocations through the
memflags parameter; the node is extracted using the
While the function checks to see if the special constant
NUMA_NO_NODE is specified, it otherwise does not handle the case where
node >= MAX_NUMNODES. This allows an out-of-bounds access to an internal array.
An attacker using crafted hypercalls can execute arbitrary code within Xen.
All versions of Xen are affected. Both ARM and x86 are affected. Both systems running HVM guests and system running PV guests are affected.