Executive brief
Xen is a hypervisor used to run multiple virtual machines on a single physical server. A flaw in how it handles certain processor instructions allows a user inside a virtual machine to peek at small amounts of sensitive data belonging to the host system. This could potentially lead to the exposure of internal system information that should remain private between the virtual machine and the physical hardware.
Technical details
The x86 instruction CMPXCHG8B is designed to ignore legacy operand size overrides, honoring only the REX.W override. However, the Xen instruction emulator incorrectly used a fully general operand size value for certain parts of the emulation. By using a supposedly-ignored operand size prefix, a local unprivileged HVM guest user can trigger this flaw to leak hypervisor stack data. Specifically, 64-bit guests can leak 96 bits of data, while other guests can leak 32 bits. The vulnerability affects Xen versions 3.3 through 4.7 on x86 systems; patches are available for supported versions.
Affected products
- Xen Project Xen 3.3.x through 4.7.x
Timeline
- 2016-12-13: advisory: XSA-200 released by Xen Project
- 2017-01-26: disclosed: NVD publication date