CVE-2017-12135

Vulnerability

The vulnerability involves multiple issues in Xen's handling of transitive grants within the GNTTABOP_copy hypercall. First, the code uses a recursive retry mechanism for copy operations on transitive grants, relying on the compiler to produce a tail call. In practice compilers often do not, leading to possibly unbounded stack recursion [1]. Second, the reference counting and locking discipline for transitive grants is broken, allowing concurrent use to leak references on the transitively-referenced grant [2]. These issues affect Xen versions up to and including those that ship with the flawed patches for XSA-226. Patches are available for Xen 4.5, 4.6, 4.7, 4.8, 4.9, and the unstable branch [2].

Exploitation

An attacker must have access to a local OS guest running on the Xen hypervisor. The attacker does not require any special privileges beyond those of a normal guest. To trigger the stack recursion bug, the attacker crafts a sequence of grant copy operations that causes the function to repeatedly reinvoke itself without making a tail call, potentially exhausting the Xen hypervisor stack. For the reference leak issue, the attacker concurrently uses a transitive grant operation to leak grant references [1][2]. Both issues can be chained or exploited independently.

Impact

A successful exploit can cause a denial of service by crashing the Xen host (host crash). Additionally, privilege escalation and information leaks cannot be ruled out, as the advisory explicitly states that privilege escalation and information leaks are possible [1][2]. The reference leak issue can lead to resource exhaustion, effectively a denial of service against the host or other guests.

Mitigation

The Xen Security Advisory XSA-226 provides patches that address both the stack recursion and the reference counting issues. The initial patch released in version 6 regressed 32-bit Dom0 or backend domains, so the final patch (version 7) fixes that regression [2]. Users should apply the appropriate patch for their Xen version (4.5, 4.6, 4.7, 4.8, 4.9, or unstable). As of the advisory's public release on 2017-08-15, no workaround other than applying the patch is available [3].