x86 shadow plus log-dirty mode use-after-free In environments where host assisted address translation is necessary but Hardware Assisted Paging (HAP) is unavailable, Xen will run guests in so called shadow mode. Shadow mode maintains a pool of memory used for both shadow page tables as well as auxiliary data structures. To migrate or snapshot guests, Xen additionally runs them in so called log-dirty mode. The data structures needed by the log-dirty tracking are part of aformentioned auxiliary data. In order to keep error handling efforts within reasonable bounds, for operations which may require memory allocations shadow mode logic ensures up front that enough memory is available for the worst case requirements. Unfortunately, while page table memory is properly accounted for on the code path requiring the potential establishing of new shadows, demands by the log-dirty infrastructure were not taken into consideration. As a result, just established shadow page tables could be freed again immediately, while other code is still accessing them on the assumption that they would remain allocated.
{
"binaries": [
{
"binary_version": "4.6.5-0ubuntu1.4",
"binary_name": "libxen-4.6"
},
{
"binary_version": "4.6.5-0ubuntu1.4",
"binary_name": "libxen-dev"
},
{
"binary_version": "4.6.5-0ubuntu1.4",
"binary_name": "libxenstore3.0"
},
{
"binary_version": "4.6.5-0ubuntu1.4",
"binary_name": "xen-hypervisor-4.4-amd64"
},
{
"binary_version": "4.6.5-0ubuntu1.4",
"binary_name": "xen-hypervisor-4.4-arm64"
},
{
"binary_version": "4.6.5-0ubuntu1.4",
"binary_name": "xen-hypervisor-4.4-armhf"
},
{
"binary_version": "4.6.5-0ubuntu1.4",
"binary_name": "xen-hypervisor-4.5-amd64"
},
{
"binary_version": "4.6.5-0ubuntu1.4",
"binary_name": "xen-hypervisor-4.5-arm64"
},
{
"binary_version": "4.6.5-0ubuntu1.4",
"binary_name": "xen-hypervisor-4.5-armhf"
},
{
"binary_version": "4.6.5-0ubuntu1.4",
"binary_name": "xen-hypervisor-4.6-amd64"
},
{
"binary_version": "4.6.5-0ubuntu1.4",
"binary_name": "xen-hypervisor-4.6-arm64"
},
{
"binary_version": "4.6.5-0ubuntu1.4",
"binary_name": "xen-hypervisor-4.6-armhf"
},
{
"binary_version": "4.6.5-0ubuntu1.4",
"binary_name": "xen-system-amd64"
},
{
"binary_version": "4.6.5-0ubuntu1.4",
"binary_name": "xen-system-arm64"
},
{
"binary_version": "4.6.5-0ubuntu1.4",
"binary_name": "xen-system-armhf"
},
{
"binary_version": "4.6.5-0ubuntu1.4",
"binary_name": "xen-utils-4.6"
},
{
"binary_version": "4.6.5-0ubuntu1.4",
"binary_name": "xen-utils-common"
},
{
"binary_version": "4.6.5-0ubuntu1.4",
"binary_name": "xenstore-utils"
}
]
}{
"binaries": [
{
"binary_version": "4.9.2-0ubuntu1",
"binary_name": "libxen-4.9"
},
{
"binary_version": "4.9.2-0ubuntu1",
"binary_name": "libxen-dev"
},
{
"binary_version": "4.9.2-0ubuntu1",
"binary_name": "libxenstore3.0"
},
{
"binary_version": "4.9.2-0ubuntu1",
"binary_name": "xen-hypervisor-4.6-amd64"
},
{
"binary_version": "4.9.2-0ubuntu1",
"binary_name": "xen-hypervisor-4.6-arm64"
},
{
"binary_version": "4.9.2-0ubuntu1",
"binary_name": "xen-hypervisor-4.6-armhf"
},
{
"binary_version": "4.9.2-0ubuntu1",
"binary_name": "xen-hypervisor-4.7-amd64"
},
{
"binary_version": "4.9.2-0ubuntu1",
"binary_name": "xen-hypervisor-4.7-arm64"
},
{
"binary_version": "4.9.2-0ubuntu1",
"binary_name": "xen-hypervisor-4.7-armhf"
},
{
"binary_version": "4.9.2-0ubuntu1",
"binary_name": "xen-hypervisor-4.8-amd64"
},
{
"binary_version": "4.9.2-0ubuntu1",
"binary_name": "xen-hypervisor-4.8-arm64"
},
{
"binary_version": "4.9.2-0ubuntu1",
"binary_name": "xen-hypervisor-4.8-armhf"
},
{
"binary_version": "4.9.2-0ubuntu1",
"binary_name": "xen-hypervisor-4.9-amd64"
},
{
"binary_version": "4.9.2-0ubuntu1",
"binary_name": "xen-hypervisor-4.9-arm64"
},
{
"binary_version": "4.9.2-0ubuntu1",
"binary_name": "xen-hypervisor-4.9-armhf"
},
{
"binary_version": "4.9.2-0ubuntu1",
"binary_name": "xen-system-amd64"
},
{
"binary_version": "4.9.2-0ubuntu1",
"binary_name": "xen-system-arm64"
},
{
"binary_version": "4.9.2-0ubuntu1",
"binary_name": "xen-system-armhf"
},
{
"binary_version": "4.9.2-0ubuntu1",
"binary_name": "xen-utils-4.9"
},
{
"binary_version": "4.9.2-0ubuntu1",
"binary_name": "xen-utils-common"
},
{
"binary_version": "4.9.2-0ubuntu1",
"binary_name": "xenstore-utils"
}
]
}{
"binaries": [
{
"binary_version": "4.11.3+24-g14b62ab3e5-1ubuntu2.3",
"binary_name": "libxen-dev"
},
{
"binary_version": "4.11.3+24-g14b62ab3e5-1ubuntu2.3",
"binary_name": "libxencall1"
},
{
"binary_version": "4.11.3+24-g14b62ab3e5-1ubuntu2.3",
"binary_name": "libxendevicemodel1"
},
{
"binary_version": "4.11.3+24-g14b62ab3e5-1ubuntu2.3",
"binary_name": "libxenevtchn1"
},
{
"binary_version": "4.11.3+24-g14b62ab3e5-1ubuntu2.3",
"binary_name": "libxenforeignmemory1"
},
{
"binary_version": "4.11.3+24-g14b62ab3e5-1ubuntu2.3",
"binary_name": "libxengnttab1"
},
{
"binary_version": "4.11.3+24-g14b62ab3e5-1ubuntu2.3",
"binary_name": "libxenmisc4.11"
},
{
"binary_version": "4.11.3+24-g14b62ab3e5-1ubuntu2.3",
"binary_name": "libxenstore3.0"
},
{
"binary_version": "4.11.3+24-g14b62ab3e5-1ubuntu2.3",
"binary_name": "libxentoolcore1"
},
{
"binary_version": "4.11.3+24-g14b62ab3e5-1ubuntu2.3",
"binary_name": "libxentoollog1"
},
{
"binary_version": "4.11.3+24-g14b62ab3e5-1ubuntu2.3",
"binary_name": "xen-hypervisor-4.11-amd64"
},
{
"binary_version": "4.11.3+24-g14b62ab3e5-1ubuntu2.3",
"binary_name": "xen-hypervisor-4.11-arm64"
},
{
"binary_version": "4.11.3+24-g14b62ab3e5-1ubuntu2.3",
"binary_name": "xen-hypervisor-4.11-armhf"
},
{
"binary_version": "4.11.3+24-g14b62ab3e5-1ubuntu2.3",
"binary_name": "xen-hypervisor-4.9-amd64"
},
{
"binary_version": "4.11.3+24-g14b62ab3e5-1ubuntu2.3",
"binary_name": "xen-hypervisor-4.9-arm64"
},
{
"binary_version": "4.11.3+24-g14b62ab3e5-1ubuntu2.3",
"binary_name": "xen-hypervisor-4.9-armhf"
},
{
"binary_version": "4.11.3+24-g14b62ab3e5-1ubuntu2.3",
"binary_name": "xen-hypervisor-common"
},
{
"binary_version": "4.11.3+24-g14b62ab3e5-1ubuntu2.3",
"binary_name": "xen-system-amd64"
},
{
"binary_version": "4.11.3+24-g14b62ab3e5-1ubuntu2.3",
"binary_name": "xen-system-arm64"
},
{
"binary_version": "4.11.3+24-g14b62ab3e5-1ubuntu2.3",
"binary_name": "xen-system-armhf"
},
{
"binary_version": "4.11.3+24-g14b62ab3e5-1ubuntu2.3",
"binary_name": "xen-utils-4.11"
},
{
"binary_version": "4.11.3+24-g14b62ab3e5-1ubuntu2.3",
"binary_name": "xen-utils-common"
},
{
"binary_version": "4.11.3+24-g14b62ab3e5-1ubuntu2.3",
"binary_name": "xenstore-utils"
}
]
}{
"binaries": [
{
"binary_version": "4.16.0-1~ubuntu2.1",
"binary_name": "libxen-dev"
},
{
"binary_version": "4.16.0-1~ubuntu2.1",
"binary_name": "libxencall1"
},
{
"binary_version": "4.16.0-1~ubuntu2.1",
"binary_name": "libxendevicemodel1"
},
{
"binary_version": "4.16.0-1~ubuntu2.1",
"binary_name": "libxenevtchn1"
},
{
"binary_version": "4.16.0-1~ubuntu2.1",
"binary_name": "libxenforeignmemory1"
},
{
"binary_version": "4.16.0-1~ubuntu2.1",
"binary_name": "libxengnttab1"
},
{
"binary_version": "4.16.0-1~ubuntu2.1",
"binary_name": "libxenhypfs1"
},
{
"binary_version": "4.16.0-1~ubuntu2.1",
"binary_name": "libxenmisc4.16"
},
{
"binary_version": "4.16.0-1~ubuntu2.1",
"binary_name": "libxenstore4"
},
{
"binary_version": "4.16.0-1~ubuntu2.1",
"binary_name": "libxentoolcore1"
},
{
"binary_version": "4.16.0-1~ubuntu2.1",
"binary_name": "libxentoollog1"
},
{
"binary_version": "4.16.0-1~ubuntu2.1",
"binary_name": "xen-hypervisor-4.16-amd64"
},
{
"binary_version": "4.16.0-1~ubuntu2.1",
"binary_name": "xen-hypervisor-4.16-arm64"
},
{
"binary_version": "4.16.0-1~ubuntu2.1",
"binary_name": "xen-hypervisor-4.16-armhf"
},
{
"binary_version": "4.16.0-1~ubuntu2.1",
"binary_name": "xen-hypervisor-common"
},
{
"binary_version": "4.16.0-1~ubuntu2.1",
"binary_name": "xen-system-amd64"
},
{
"binary_version": "4.16.0-1~ubuntu2.1",
"binary_name": "xen-system-arm64"
},
{
"binary_version": "4.16.0-1~ubuntu2.1",
"binary_name": "xen-system-armhf"
},
{
"binary_version": "4.16.0-1~ubuntu2.1",
"binary_name": "xen-utils-4.16"
},
{
"binary_version": "4.16.0-1~ubuntu2.1",
"binary_name": "xen-utils-common"
},
{
"binary_version": "4.16.0-1~ubuntu2.1",
"binary_name": "xenstore-utils"
}
]
}{
"binaries": [
{
"binary_version": "4.17.3+10-g091466ba55-1.1ubuntu3",
"binary_name": "libxen-dev"
},
{
"binary_version": "4.17.3+10-g091466ba55-1.1ubuntu3",
"binary_name": "libxencall1t64"
},
{
"binary_version": "4.17.3+10-g091466ba55-1.1ubuntu3",
"binary_name": "libxendevicemodel1t64"
},
{
"binary_version": "4.17.3+10-g091466ba55-1.1ubuntu3",
"binary_name": "libxenevtchn1t64"
},
{
"binary_version": "4.17.3+10-g091466ba55-1.1ubuntu3",
"binary_name": "libxenforeignmemory1t64"
},
{
"binary_version": "4.17.3+10-g091466ba55-1.1ubuntu3",
"binary_name": "libxengnttab1t64"
},
{
"binary_version": "4.17.3+10-g091466ba55-1.1ubuntu3",
"binary_name": "libxenhypfs1t64"
},
{
"binary_version": "4.17.3+10-g091466ba55-1.1ubuntu3",
"binary_name": "libxenmisc4.17t64"
},
{
"binary_version": "4.17.3+10-g091466ba55-1.1ubuntu3",
"binary_name": "libxenstore4t64"
},
{
"binary_version": "4.17.3+10-g091466ba55-1.1ubuntu3",
"binary_name": "libxentoolcore1t64"
},
{
"binary_version": "4.17.3+10-g091466ba55-1.1ubuntu3",
"binary_name": "libxentoollog1t64"
},
{
"binary_version": "4.17.3+10-g091466ba55-1.1ubuntu3",
"binary_name": "xen-hypervisor-4.17-amd64"
},
{
"binary_version": "4.17.3+10-g091466ba55-1.1ubuntu3",
"binary_name": "xen-hypervisor-4.17-arm64"
},
{
"binary_version": "4.17.3+10-g091466ba55-1.1ubuntu3",
"binary_name": "xen-hypervisor-4.17-armhf"
},
{
"binary_version": "4.17.3+10-g091466ba55-1.1ubuntu3",
"binary_name": "xen-hypervisor-common"
},
{
"binary_version": "4.17.3+10-g091466ba55-1.1ubuntu3",
"binary_name": "xen-system-amd64"
},
{
"binary_version": "4.17.3+10-g091466ba55-1.1ubuntu3",
"binary_name": "xen-system-arm64"
},
{
"binary_version": "4.17.3+10-g091466ba55-1.1ubuntu3",
"binary_name": "xen-system-armhf"
},
{
"binary_version": "4.17.3+10-g091466ba55-1.1ubuntu3",
"binary_name": "xen-utils-4.17"
},
{
"binary_version": "4.17.3+10-g091466ba55-1.1ubuntu3",
"binary_name": "xen-utils-common"
},
{
"binary_version": "4.17.3+10-g091466ba55-1.1ubuntu3",
"binary_name": "xenstore-utils"
}
]
}{
"binaries": [
{
"binary_version": "4.20.0-1ubuntu1",
"binary_name": "libxen-dev"
},
{
"binary_version": "4.20.0-1ubuntu1",
"binary_name": "libxencall1"
},
{
"binary_version": "4.20.0-1ubuntu1",
"binary_name": "libxendevicemodel1"
},
{
"binary_version": "4.20.0-1ubuntu1",
"binary_name": "libxenevtchn1"
},
{
"binary_version": "4.20.0-1ubuntu1",
"binary_name": "libxenforeignmemory1"
},
{
"binary_version": "4.20.0-1ubuntu1",
"binary_name": "libxengnttab1"
},
{
"binary_version": "4.20.0-1ubuntu1",
"binary_name": "libxenhypfs1"
},
{
"binary_version": "4.20.0-1ubuntu1",
"binary_name": "libxenmisc4.20"
},
{
"binary_version": "4.20.0-1ubuntu1",
"binary_name": "libxenstore4"
},
{
"binary_version": "4.20.0-1ubuntu1",
"binary_name": "libxentoolcore1"
},
{
"binary_version": "4.20.0-1ubuntu1",
"binary_name": "libxentoollog1"
},
{
"binary_version": "4.20.0-1ubuntu1",
"binary_name": "xen-hypervisor-4.20-amd64"
},
{
"binary_version": "4.20.0-1ubuntu1",
"binary_name": "xen-hypervisor-4.20-arm64"
},
{
"binary_version": "4.20.0-1ubuntu1",
"binary_name": "xen-hypervisor-common"
},
{
"binary_version": "4.20.0-1ubuntu1",
"binary_name": "xen-system-amd64"
},
{
"binary_version": "4.20.0-1ubuntu1",
"binary_name": "xen-system-arm64"
},
{
"binary_version": "4.20.0-1ubuntu1",
"binary_name": "xen-utils-4.20"
},
{
"binary_version": "4.20.0-1ubuntu1",
"binary_name": "xen-utils-common"
},
{
"binary_version": "4.20.0-1ubuntu1",
"binary_name": "xenstore-utils"
}
]
}{
"binaries": [
{
"binary_version": "4.20.0+68-g35cb38b222-1",
"binary_name": "libxen-dev"
},
{
"binary_version": "4.20.0+68-g35cb38b222-1",
"binary_name": "libxencall1"
},
{
"binary_version": "4.20.0+68-g35cb38b222-1",
"binary_name": "libxendevicemodel1"
},
{
"binary_version": "4.20.0+68-g35cb38b222-1",
"binary_name": "libxenevtchn1"
},
{
"binary_version": "4.20.0+68-g35cb38b222-1",
"binary_name": "libxenforeignmemory1"
},
{
"binary_version": "4.20.0+68-g35cb38b222-1",
"binary_name": "libxengnttab1"
},
{
"binary_version": "4.20.0+68-g35cb38b222-1",
"binary_name": "libxenhypfs1"
},
{
"binary_version": "4.20.0+68-g35cb38b222-1",
"binary_name": "libxenmisc4.20"
},
{
"binary_version": "4.20.0+68-g35cb38b222-1",
"binary_name": "libxenstore4"
},
{
"binary_version": "4.20.0+68-g35cb38b222-1",
"binary_name": "libxentoolcore1"
},
{
"binary_version": "4.20.0+68-g35cb38b222-1",
"binary_name": "libxentoollog1"
},
{
"binary_version": "4.20.0+68-g35cb38b222-1",
"binary_name": "xen-hypervisor-4.20-amd64"
},
{
"binary_version": "4.20.0+68-g35cb38b222-1",
"binary_name": "xen-hypervisor-4.20-arm64"
},
{
"binary_version": "4.20.0+68-g35cb38b222-1",
"binary_name": "xen-hypervisor-common"
},
{
"binary_version": "4.20.0+68-g35cb38b222-1",
"binary_name": "xen-system-amd64"
},
{
"binary_version": "4.20.0+68-g35cb38b222-1",
"binary_name": "xen-system-arm64"
},
{
"binary_version": "4.20.0+68-g35cb38b222-1",
"binary_name": "xen-utils-4.20"
},
{
"binary_version": "4.20.0+68-g35cb38b222-1",
"binary_name": "xen-utils-common"
},
{
"binary_version": "4.20.0+68-g35cb38b222-1",
"binary_name": "xenstore-utils"
}
]
}