cxenstored: Race in domain cleanup

2017-09-12T12:00:00
ID XSA-233
Type xen
Reporter Xen Project
Modified 2017-09-12T12:03:00

Description

ISSUE DESCRIPTION

When shutting down a VM with a stubdomain, a race in cxenstored may cause a double-free.

IMPACT

The xenstored daemon may crash, resulting in a DoS of any parts of the system relying on it (including domain creation / destruction, ballooning, device changes, etc).

VULNERABLE SYSTEMS

All versions of Xen are vulnerable. Only systems running the C version os xenstored ("xenstored") are vulnerable; systems running the Ocaml version ("oxenstored") are not vulnerable. Only systems running devicemodel stubdomains are vulnerable. Only x86 HVM guests can use stubdomains. Therefore ARM systems, x86 systems running only PV guests, and x86 systems running HVM guests with the devicemodel not in a stubdomain (eg in dom0), are not vulnerable.