Re: Xen Security Advisory 464 v2 (CVE-2024-45819) - libxl leaks data to PVH guests via ACPI tables

[Andrew Cooper <andrew.cooper3 () citrix com>]

On 12/11/2024 5:17 pm, Demi Marie Obenour wrote:
> On Tue, Nov 12, 2024 at 12:05:47PM +0000, Xen Security wrote:
> > Only PVH guests can leverage the vulnerability.  HVM and PV guests
> > cannot leverage the vulnerability.  Note that PV guests when run inside
> > the (PVH) shim can't leverage the vulnerability.
> Is this unconditional (perhaps because the relevant data gets zeroed out
> by the shim), or does it only apply when the PV guest can't extract data
> from the shim's memory?  For instance, 32-bit PV guests aren't security
> supported anymore, but the PV shim isn't supposed to rely on the
> security of the shim itself, only of the rest of the system.

Data are leaked into the PVShim guest, but it is the shim Xen
(exclusively) which has access to the ACPI tables.

The guest which has been shim'd can't architecturally access the leaked
data.

~Andrew