page type reference leak on x86

ISSUE DESCRIPTION

The page type system of Xen requires cleanup when the last reference for a given page is being dropped. In order to exclude simultaneous updates to a given page by multiple parties, pages which are updated are locked beforehand. This locking includes temporarily increasing the type reference count by one. When the page is later unlocked, the context precludes cleanup, so the reference that is then dropped must not be the last one. This was not properly enforced.

IMPACT

A malicious or buggy PV guest may cause a memory leak upon shutdown of the guest, ultimately perhaps resulting in Denial of Service (DoS) affecting the entire host.

VULNERABLE SYSTEMS

All Xen versions from 3.4 onwards are vulnerable. Xen versions 3.3 and earlier are not vulnerable.
Only x86 systems are affected. ARM systems are not affected.
Only x86 PV guests can leverage the vulnerability. x86 HVM guests cannot leverage the vulnerability.