Unlimited recursion in linear pagetable de-typing

ISSUE DESCRIPTION

x86 PV guests are permitted to set up certain forms of what is often called “linear page tables”, where pagetables contain references to other pagetables at the same level or higher. Certain restrictions apply in order to fit into Xen’s page type handling system. An important restriction was missed, however: Stacking multiple layers of page tables of the same level on top of one another is not very useful, and the tearing down of such an arrangement involves recursion. With sufficiently many layers such recursion will result in a stack overflow, commonly resulting in Xen to crash.

IMPACT

A malicious or buggy PV guest may cause the hypervisor to crash, resulting in Denial of Service (DoS) affecting the entire host. Privilege escalation and information leaks cannot be excluded.

VULNERABLE SYSTEMS

All Xen versions from at least 3.2 onwards are vulnerable. Earlier versions have not been checked.
Only x86 systems are affected. ARM systems are not affected.
Only x86 PV guests can leverage the vulnerability. x86 HVM guests cannot leverage the vulnerability.