XENMEM_exchange may overwrite hypervisor memory

ISSUE DESCRIPTION

The handler for XENMEM_exchange accesses guest memory without range checking the guest provided addresses, thus allowing these accesses to include the hypervisor reserved range.

IMPACT

A malicious guest administrator can cause Xen to crash. If the out of address space bounds access does not lead to a crash, a carefully crafted privilege escalation cannot be excluded, even though the guest doesn’t itself control the values written.

VULNERABLE SYSTEMS

All Xen versions are vulnerable.
The vulnerability is only exposed to PV guests.