Several memory hypercall operations allow invalid extent order values

ISSUE DESCRIPTION

Allowing arbitrary extent_order input values for XENMEM_decrease_reservation, XENMEM_populate_physmap, and XENMEM_exchange can cause arbitrarily long time being spent in loops without allowing vital other code to get a chance to execute. This may also cause inconsistent state resulting at the completion of these hypercalls.

IMPACT

A malicious guest administrator can cause Xen to hang.

VULNERABLE SYSTEMS

All Xen versions are vulnerable. However, older versions (not supporting Populate-on-Demand, i.e. before 3.4) may only be theoretically affected.