A PV guest could DoS Xen while unmapping a grant

ISSUE DESCRIPTION

To address XSA-380, reference counting was introduced for grant mappings for the case where a PV guest would have the IOMMU enabled. PV guests can request two forms of mappings. When both are in use for any individual mapping, unmapping of such a mapping can be requested in two steps. The reference count for such a mapping would then mistakenly be decremented twice. Underflow of the counters gets detected, resulting in the triggering of a hypervisor bug check.

IMPACT

Malicious guest kernels may be able to mount a Denial of Service (DoS) attack affecting the entire system.

VULNERABLE SYSTEMS

All Xen versions from at least 3.2 onwards are vulnerable in principle, if they have the XSA-380 fixes applied.
Only x86 systems are vulnerable. Arm systems are not vulnerable.
Only x86 PV guests with access to PCI devices can leverage the vulnerability. x86 HVM and PVH guests, as well as PV guests without access to PCI devices, cannot leverage the vulnerability.
Additionally from Xen 4.13 onwards x86 PV guests can leverage this vulnerability only when being granted access to pages owned by another domain.