race in VT-d domain ID cleanup

ISSUE DESCRIPTION

Xen domain IDs are up to 15 bits wide. VT-d hardware may allow for only less than 15 bits to hold a domain ID associating a physical device with a particular domain. Therefore internally Xen domain IDs are mapped to the smaller value range. The cleaning up of the housekeeping structures has a race, allowing for VT-d domain IDs to be leaked and flushes to be bypassed.

IMPACT

The precise impact is system specific, but would typically be a Denial of Service (DoS) affecting the entire host. Privilege escalation and information leaks cannot be ruled out.

VULNERABLE SYSTEMS

Xen versions 4.11 through 4.16 are vulnerable. Xen versions 4.10 and earlier are not vulnerable.
Only x86 systems with VT-d IOMMU hardware are vulnerable. Arm systems as well as x86 systems without VT-d hardware or without any IOMMUs in use are not vulnerable.
Only x86 guests which have physical devices passed through to them can leverage the vulnerability.