x86 pv: Race condition in typeref acquisition

ISSUE DESCRIPTION

Xen maintains a type reference count for pages, in addition to a regular reference count. This scheme is used to maintain invariants required for Xen’s safety, e.g. PV guests may not have direct writeable access to pagetables; updates need auditing by Xen.
Unfortunately, the logic for acquiring a type reference has a race condition, whereby a safely TLB flush is issued too early and creates a window where the guest can re-establish the read/write mapping before writeability is prohibited.

IMPACT

Malicious x86 PV guest administrators may be able to escalate privilege so as to control the whole system.

VULNERABLE SYSTEMS

All versions of Xen are vulnerable.
Only x86 PV guests can trigger this vulnerability.
To exploit the vulnerability, there needs to be an undue delay at just the wrong moment in _get_page_type(). The degree to which an x86 PV guest can practically control this race condition is unknown.