mirror of
https://github.com/xen-project/xen.git
synced 2026-10-28 10:11:27 +01:00
Andrew Cooper
59e89cdabc
CVE-2018-12207 covers a set of errata on various Intel processors, whereby a machine check exception can be generated in a corner case when an executable mapping changes size or cacheability without TLB invalidation. HVM guest kernels can trigger this to DoS the host. To mitigate, in affected hardware, all EPT superpages are marked NX. When an instruction fetch violation is observed against the superpage, the superpage is shattered to 4k and has execute permissions restored. This prevents the guest kernel from being able to create the necessary preconditions in the iTLB to exploit the vulnerability. This does come with a workload-dependent performance overhead, caused by increased TLB pressure. Performance can be restored, if guest kernels are trusted not to mount an attack, by specifying ept=exec-sp on the command line. This is part of XSA-304 / CVE-2018-12207 Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Acked-by: George Dunlap <george.dunlap@citrix.com> Reviewed-by: Jan Beulich <jbeulich@suse.com>