Missing memory barriers when accessing/allocating an event channel

ISSUE DESCRIPTION

Event channels control structures can be accessed lockless as long as the port is considered to be valid. Such sequence is missing appropriate memory barrier (e.g smp_*mb()) to prevent both the compiler and CPU to re-order access.

IMPACT

A malicious guest may be able to cause a hypervisor crash resulting in a Denial of Service (DoS). Information leak and privilege escalation cannot be excluded.

VULNERABLE SYSTEMS

Systems running all versions of Xen are affected. Whether a system is vulnerable will depend on the CPU and compiler used to build Xen.
For all the systems, the presence and the scope of the vulnerability depends on the precise re-ordering performed by the compiler used to build Xen.
We have not been able to survey compilers; consequently we cannot say which compiler(s) might produce vulnerable code (with which code generation options). GCC documentation clearly suggests that re-ordering is possible.
Arm systems will also be vulnerable if the CPU is able to re-order memory access. Please consult your CPU vendor.
x86 systems are only vulnerable if a compiler performs re-ordering.