PVH guests have their ACPI tables constructed by the toolstack. The
construction involves building the tables in local memory, which are
then copied into guest memory. While actually used parts of the local
memory are filled in correctly, excess space that is being allocated is
left with its prior contents.
An unprivileged guest may be able to access sensitive information
pertaining to the host, control domain, or other guests.
CAPEC ID: N/A
Description: An unprivileged guest may be able to access sensitive information
pertaining to the host, control domain, or other guests.
Solutions
Configurations
Xen versions 4.8 and onwards are vulnerable. Xen 4.7 and older are not
vulnerable.
Only x86 systems running PVH guests are vulnerable. Architectures other
than x86 are not vulnerable.
Only PVH guests can leverage the vulnerability. HVM and PV guests
cannot leverage the vulnerability. Note that PV guests when run inside
the (PVH) shim can't leverage the vulnerability.
Workarounds
Running only PV or HVM guests will avoid this vulnerability.
Exploits
Credits
finder
This issue was discovered by Jason Andryuk of AMD.