Konrad Rzeszutek Wilk

**Name of the Vulnerable Software and Affected Versions** Xen versions 3.1.x through 4.3.x **Description** The issue allows local guest administrators to cause a denial of service by leveraging a system with access to a passed-through MSI or MSI-X capable physical PCI device and a crafted sequence of XEN PCI OP * operations. This can result in a NULL pointer dereference and host OS crash. **Recommendations** For versions 3.1.x through 4.3.x, apply the necessary patches to fix the missing sanity checks in the PCI backend driver. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Xen versions 3.1.x through 4.3.x **Description** The issue allows local guest administrators to generate a continuous stream of WARN messages and cause a denial of service by consuming disk space. This can be achieved by leveraging a system with access to a passed-through MSI or MSI-X capable physical PCI device and utilizing `XEN PCI OP enable msi` operations. **Recommendations** For versions 3.1.x through 4.3.x, consider restricting access to the `XEN PCI OP enable msi` operations to prevent the generation of a continuous stream of WARN messages and subsequent denial of service. As a temporary workaround, limit the ability of local guest administrators to access passed-through MSI or MSI-X capable physical PCI devices until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Xen versions 3.2.x through 4.5.x **Description** The issue concerns the XEN DOMCTL memory mapping hypercall in Xen, which is not preemptible when using a PCI passthrough device. This could allow local users of the x86 HVM domain to cause a denial of service, specifically host CPU consumption, by making a crafted request to the device model (qemu-dm). **Recommendations** For Xen versions 3.2.x through 4.5.x, consider disabling the PCI passthrough device as a temporary workaround to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.