5.7 Medium
CVSS2
Attack Vector
ADJACENT_NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:A/AC:M/Au:N/C:N/I:N/A:C
0.002 Low
EPSS
Percentile
55.4%
HVM guests are able to manipulate their physical address space such that processing a subsequent request by that guest to disable caches takes an extended amount of time changing the cachability of the memory pages assigned to this guest. This applies only when the guest has been granted access to some memory mapped I/O region (typically by way of assigning a passthrough PCI device).
This can cause the CPU which processes the request to become unavailable, possibly causing the hypervisor or a guest kernel (including the domain 0 one) to halt itself (“panic”).
A malicious domain, given access to a device with memory mapped I/O regions, can cause the host to become unresponsive for a period of time, potentially leading to a DoS affecting the whole system.
Xen version 3.3 onwards is vulnerable.
Only systems using the Intel variant of Hardware Assisted Paging (aka EPT) are vulnerable.