An untrusted domain with access to a physical device can DMA into host memory, leading to privilege escalation.
Tag: Xen
ASA-2019-00628 – Xen: Missing descriptor table limit checking in x86 PV emulation
When emulating certain PV guest operations, descriptor table accesses are performed by the emulating code. Such accesses should respect the guest specified limits, unless otherwise guaranteed to fail in such a case. Without this, emulation of 32-bit guest user mode calls through call gates would allow guest user mode to install and then use descriptors of their choice, as long as the guest kernel did not itself install an LDT. (Most OSes don't install any LDT by default).
ASA-2019-00627 – Xen: Passed through PCI devices may corrupt host memory after deassignment
An untrusted domain with access to a physical device can DMA into host memory, leading to privilege escalation.
ASA-2019-00626 – Xen: add-to-physmap can be abused to Denial of Service (DoS) ARM hosts
A malicious guest administrator may cause a hypervisor crash, resulting in a Denial of Service (DoS).
ASA-2019-00625 – Xen: Interrupts are unconditionally unmasked in exception handlers
A malicious guest might contrive to arrange for critical Xen code to run with interrupts erroneously enabled. This could lead to data corruption, denial of service, or possibly even privilege escalation. However a precise attack technique has not been identified.
ASA-2019-00624 – Xen: Issues with restartable PV type change operations
A malicious PV guest administrator may be able to escalate their privilege to that of the host.
ASA-2019-00623 – Xen: VCPUOP_initialise Denial of Service (DoS)
Malicious guests may cause a hypervisor crash, resulting in a Denial of Service (Dos).
ASA-2019-00278 – Xen: Microarchitectural Data Sampling speculative side channel
Microarchitectural Data Sampling refers to a group of speculative sidechannels vulnerabilities. They consist of: * CVE-2018-12126 - MSBDS - Microarchitectural Store Buffer Data Sampling * CVE-2018-12127 - MLPDS - Microarchitectural Load Port Data Sampling * CVE-2018-12130 - MFBDS - Microarchitectural Fill Buffer Data Sampling * CVE-2019-11091 - MDSUM - Microarchitectural Data Sampling Uncacheable Memory These issues pertain to the Load Ports, Store Buffers and Fill Buffers in the pipeline. The Load Ports are used to service all memory reads. The Store Buffers service all in-flight speculative writes (including IO Port writes), while the Fill Buffers service all memory writes which are post-retirement, and no longer speculative. Under certain circumstances, a later load which takes a fault or assist (an internal condition to processor e.g. setting a pagetable Access or Dirty bit) may be forwarded stale data from these buffers during speculative execution, which may then be leaked via a sidechannel. MDSUM (Uncacheable Memory) is a special case of the other three. Previously, the use of uncacheable memory was believed to be safe against speculative sidechannels. An attacker, which could include a malicious untrusted user process on a trusted guest, or an untrusted guest, can sample the content of recently-used memory operands and IO Port writes. This can include data from: A previously executing context (process, or guest, or hypervisor/toolstack) at the same privilege level. A higher privilege context (kernel, hypervisor, SMM) which interrupted the attacker's execution. Vulnerable data is that on the same physical core as the attacker. This includes, when hyper-threading is enabled, adjacent threads. An attacker cannot use this vulnerability to target specific data. An attack would likely require sampling over a period of time and the application of statistical methods to reconstruct interesting data.