FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

xen-kernel -- x86: Disallow L3 recursive pagetable for 32-bit PV guests

Affected packages
xen-kernel < 4.7.1

Details

VuXML ID 45ca25b5-ba4d-11e6-ae1b-002590263bf5
Discovery 2016-09-08
Entry 2016-12-04

The Xen Project reports:

On real hardware, a 32-bit PAE guest must leave the USER and RW bit clear in L3 pagetable entries, but the pagetable walk behaves as if they were set. (The L3 entries are cached in processor registers, and don't actually form part of the pagewalk.)

When running a 32-bit PV guest on a 64-bit Xen, Xen must always OR in the USER and RW bits for L3 updates for the guest to observe architectural behaviour. This is unsafe in combination with recursive pagetables.

As there is no way to construct an L3 recursive pagetable in native 32-bit PAE mode, disallow this option in 32-bit PV guests.

A malicious 32-bit PV guest administrator can escalate their privilege to that of the host.

References

CVE Name CVE-2016-7092
FreeBSD PR ports/214936
URL https://xenbits.xen.org/xsa/advisory-185.html