CVE-2014-8594

Vulnerability

The do_mmu_update function in arch/x86/mm.c in Xen 4.x through 4.4.x fails to restrict certain MMU update operations to only PV page tables. This allows a PV domain to perform operations on HVM guests using Hardware Assisted Paging (HAP) that access function pointers that remain NULL when HAP is in use, leading to a NULL pointer dereference. Systems running Xen 4.0 and later are affected [1].

Exploitation

An attacker needs control of a PV domain that has privilege over other HVM or PVH guests; typically this means a device-model emulator (qemu-dm) for those guests. The PV domain launches MMU update hypercalls targeting the HAP-based guest, causing Xen to dereference a NULL pointer. The vulnerability is only exposed to PV service domains for HVM or PVH guests [1].

Impact

Successful exploitation results in a denial of service (hypervisor crash). However, because a PV guest can map memory at address 0, the NULL pointer dereference can be leveraged beyond a crash to achieve privilege escalation within the hypervisor, affecting the entire host system [1].

Mitigation

Patches were released as part of XSA-109 for Xen 4.2 and 4.4 series (xsa109.patch, xsa109-4.2.patch). Gentoo recommends upgrading to Xen 4.4.2-r1 or Xen 4.2.5-r8 [2]. Users of disaggregated systems should ensure restricted service domain images are properly configured [1].