race when migrating timers between x86 HVM vCPU-s

2020-09-2212:00:00

Xen Project

xenbits.xen.org

1.9 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:N/I:N/A:P

4.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

0.0004 Low

EPSS

Percentile

14.4%

JSON

ISSUE DESCRIPTION

When migrating timers of x86 HVM guests between its vCPU-s, the locking model used allows for a second vCPU of the same guest also operating on the timers to release a lock that it didn’t acquire.

IMPACT

The most likely effect of the issue is a hang or crash of the hypervisor, i.e. a Denial of Service (DoS).

VULNERABLE SYSTEMS

All versions of Xen are affected.
Only x86 systems are vulnerable. Arm systems are not vulnerable.
Only x86 HVM guests can leverage the vulnerability. x86 PV and PVH cannot leverage the vulnerability.
Only guests with more than one vCPU can exploit the vulnerability.