George Dunlap

**Name of the Vulnerable Software and Affected Versions** Xen versions through 4.12.x **Description** The issue is related to a flaw in restartable PV type change operations, which can be exploited by a remote attacker to gain access to confidential data, compromise its integrity, and cause a denial of service. Specifically, the problem lies in the handling of pagetable promotion and demotion operations, where race conditions can be leveraged by x86 PV guest OS users to gain host OS privileges. Xen's use of a type system to track page usage and prevent direct modification of hardware pagetables by guests is compromised by the complexity of making recursive pagetable promotion and demotion operations restartable, leading to potential races that can cause Xen to drop or retain extra type counts. This could allow malicious PV guest administrators to escalate their privileges to that of the host. All x86 systems with untrusted PV guests are vulnerable. **Recommendations** For Xen versions through 4.12.x, consider disabling the use of PV guests until a patch is available, or restrict access to the `pagetable promotion` and `demotion operations` to minimize the risk of exploitation. As a temporary workaround, avoid using recursive promotions and demotions in pagetable operations. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Xen versions prior to 4.10 **Description** The issue is related to the mishandling of Populate on Demand (PoD) Physical-to-Machine (P2M) errors, allowing HVM guest OS users to gain privileges on the host OS, obtain sensitive information, or cause a denial of service. It is also described as a use-after-free vulnerability in the Xen hypervisor. **Recommendations** For Xen versions prior to 4.10, update to version 4.10 or later to resolve the issue. As a temporary workaround, consider restricting access to the HVM guest OS to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Xen (affected versions not specified) **Description** The issue allows local x86 guest OS users to modify arbitrary memory, obtain sensitive information, cause a denial of service (host crash), or execute arbitrary code on the host. This is due to broken emulation of bit test instructions when Xen runs on a 64-bit hypervisor. The vulnerability can be exploited by leveraging insufficient input validation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Xen versions 4.1.x through 4.6.x **Description** The issue is related to the libxl toolstack library in Xen, which does not properly release mappings of files used as kernels and initial ramdisks when managing multiple domains in the same process. This allows attackers to cause a denial of service by consuming memory and disk space through starting domains. **Recommendations** For Xen versions 4.1.x through 4.6.x, consider restricting the management of multiple domains in the same process to minimize the risk of exploitation. As a temporary workaround, consider limiting the number of domains that can be started in the same process until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Xen versions 4.0.x through 4.2.x **Description** The issue allows local HVM guest domains to gain privileges or cause a denial of service via a DMA instruction when IOMMU is disabled. This occurs because the xenlight library provides access to a busmastering-capable PCI passthrough device before the IOMMU setup is complete. **Recommendations** For Xen versions 4.0.x through 4.2.x, consider disabling the PCI passthrough device until a patch is available to complete the IOMMU setup before providing access to the device. As a temporary workaround, enable IOMMU to prevent unauthorized access to the PCI passthrough device.