CVE-2020-29566— Xen 处理逻辑错误漏洞

N/A

An issue was discovered in Xen through 4.14.x. When they require assistance from the device model, x86 HVM guests must be temporarily de-scheduled. The device model will signal Xen when it has completed its operation, via an event channel, so that the relevant vCPU is rescheduled. If the device model were to signal Xen without having actually completed the operation, the de-schedule / re-schedule cycle would repeat. If, in addition, Xen is resignalled very quickly, the re-schedule may occur before the de-schedule was fully complete, triggering a shortcut. This potentially repeating process uses ordinary recursive function calls, and thus could result in a stack overflow. A malicious or buggy stubdomain serving a HVM guest can cause Xen to crash, resulting in a Denial of Service (DoS) to the entire host. Only x86 systems are affected. Arm systems are not affected. Only x86 stubdomains serving HVM guests can exploit the vulnerability.

N/A

N/A

Xen 处理逻辑错误漏洞

Xen是英国剑桥（Cambridge）大学的一款开源的虚拟机监视器产品。该产品能够使不同和不兼容的操作系统运行在同一台计算机上，并支持在运行时进行迁移，保证正常运行并且避免宕机。 Xen 4.14.x 版本存在处理逻辑错误漏洞，该漏洞源于当它们需要来自设备模型的帮助时，x86 HVM客户机必须临时取消调度。设备模型将在Xen完成操作后通过事件通道发送信号，以便重新调度相关的vCPU。如果设备模型在没有实际完成操作的情况下就向Xen发出信号，那么取消调度的重新调度周期将重复。

N/A

N/A