A guest started with Populated on Demand enabled (PoD) can attempt to
reclaim pages which aren't regular guest RAM. This can cause corruption
of memory management state in Xen.
A buggy or malicious guest can cause corruption of Xen's state, leading
to crashes or other malfunctions. Information leak and privilege
escalation cannot be ruled out.
CAPEC ID: N/A
Description: A buggy or malicious guest can cause corruption of Xen's state, leading
to crashes or other malfunctions. Information leak and privilege
escalation cannot be ruled out.
Solutions
Configurations
All Xen versions from 3.4 onwards are vulnerable. Xen versions 3.3 and
earlier are not vulnerable.
Only x86 systems are vulnerable.
Only x86 HVM and PVH guests started in populate-on-demand mode are
believed to be able to leverage the vulnerability. Populate-on-demand
mode is activated when the guest's xl configuration file specifies a
"maxmem" value which is larger than the "memory" value.
Workarounds
Running only PV guests or HVM/PVH guests without PoD will avoid the
vulnerability.