Arm: unbounded memory consumption for 2nd-level page tables

ISSUE DESCRIPTION

Certain actions require e.g. removing pages from a guest’s P2M (Physical-to-Machine) mapping. When large pages are in use to map guest pages in the 2nd-stage page tables, such a removal operation may incur a memory allocation (to replace a large mapping with individual smaller ones).
These memory allocations are taken from the global memory pool. A malicious guest might be able to cause the global memory pool to be exhausted by manipulating its own P2M mappings.

IMPACT

A malicious guest could cause a Denial of Service, preventing any system operation requiring further allocation of Xen memory, including creating new guests. NB however that memory exhaustion by itself shouldn’t cause either Xen or properly-written guests to crash.

VULNERABLE SYSTEMS

All versions of Xen are affected.
Only Arm systems are vulnerable. x86 systems are not vulnerable.