Xen.org security team
2018-11-06 18:41:04 UTC
guest use of HLE constructs may lock up host
Various Intel CPU models have an erratum listed under the title
"Processor May Hang When Executing Code In an HLE Transaction". It
describes a potential hang when using instructions with the XACQUIRE
prefix on the host physical memory range covering the first 4 MiB
starting at the 1GiB boundary.
A malicious or buggy guest may cause a CPU to hang, resulting in a DoS
(Denial of Service) affecting the entire host.
All Xen versions are affected.
Only Intel based x86 systems are affected. Please refer to Intel
documentation as to which specific CPU models are affected.
AMD x86 systems as well as Arm ones are not affected.
There is no known mitigation. A BIOS update may be available for some
systems, working around the issue at the firmware level.
Applying the appropriate pair of attached patches works around this issue
for the CPU models known to be affected at the time of writing.
xsa282-4.11-1.patch + xsa282-2.patch Xen 4.11.x, Xen 4.10.x
xsa282-4.9-1.patch + xsa282-2.patch Xen 4.9.x
xsa282-4.9-1.patch + xsa282-4.8-2.patch Xen 4.8.x, Xen 4.7.x
$ sha256sum xsa282*
NOTE REGARDING LACK OF EMBARGO
The issue has been documented publicly in Specification Updates for at
least some of the affected processors for quite some time.