Executive brief
A vulnerability exists in the QEMU component of the Xen hypervisor, which is used to run virtual machines. A malicious administrator of a guest virtual machine can exploit a timing flaw to break out of their isolated environment and gain control over the host system. This could lead to a total compromise of the host server and all other virtual machines running on it.
Technical details
A race condition exists in QEMU's handling of shared rings between the emulator and the hypervisor. Due to improper synchronization or compiler optimizations, QEMU may fetch data from these shared rings twice. A malicious guest administrator can modify the data in the shared memory between the first and second fetch, leading to inconsistent state and potential arbitrary code execution within the QEMU process. On systems without stub domains or other deprivileging mechanisms, this allows a guest-to-host escape. The vulnerability specifically affects x86 HVM guests; ARM and PV guests are not impacted. Patches are available for various QEMU and Xen versions (XSA-197).
Affected products
- QEMU QEMU up to and including 2.7.1, 2.8.0-rc0
- Xen Project Xen All versions using QEMU for x86 HVM guests
- Citrix XenServer 6.0.2, 6.2.0, 6.5, 7.0
Timeline
- 2016-11-22: advisory: Xen Project released XSA-197
- 2016-12-31: patched: Gentoo released updated packages
- 2017-01-23: disclosed: NVD publication date