Denial of Service in Linux Kernel Xen Netback

Executive Summary

This vulnerability exists in the Linux kernel's Xen network backend (xen-netback). A malicious or buggy Xen guest can set the "multi-queue-num-queues" key to zero, which is not properly validated by the backend. The connect() function only checks if the requested number of queues exceeds the maximum allowed but does not check if it is zero. This leads to an invalid memory allocation call with zero size, triggering a warning in the kernel.

Because the Xen network interface specification requires the queue count to be greater than zero, this zero value is invalid. The lack of validation can cause the system to hit a WARN_ON_ONCE condition in the kernel's memory allocation code.

On systems configured with panic_on_warn=1, this warning causes the host system to panic, resulting in a denial of service (DoS) from the guest to the host.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow a malicious or buggy Xen guest to cause a denial of service (DoS) on the host system by triggering a kernel panic.

Specifically, by setting the multi-queue number of queues to zero, the guest can cause the host kernel to hit a warning that, if configured to panic on warnings, will crash the host system.

This can disrupt services running on the host and affect availability.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, ensure that your Linux kernel is updated with the patch that adds a zero check for the 'multi-queue-num-queues' key in the xen-netback backend.

This patch prevents a malicious or buggy Xen guest from setting the queue count to zero, which can cause a guest-to-host denial of service on systems with panic_on_warn=1.

Additionally, verify that the Xen network interface configuration complies with the specification requiring the queue count to be greater than zero.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a Xen guest writing a zero value to the xenbus key "multi-queue-num-queues", which is invalid according to the Xen network interface specification.

To detect this vulnerability on your system, you can check the value of the "multi-queue-num-queues" key in the xenbus for any guest domains. A zero value indicates the presence of the problematic configuration.

Suggested commands to detect this condition include inspecting the xenstore keys for each guest domain. For example:

• Use the xenstore-ls command to list the xenbus keys for a specific domain: xenstore-ls /local/domain/<domid>/device/vif/<vifid>/multi-queue-num-queues
• Alternatively, use xenstore-read to read the specific key: xenstore-read /local/domain/<domid>/device/vif/<vifid>/multi-queue-num-queues

If the output is "0", this indicates the guest is requesting zero queues, which triggers the vulnerability.

Useful 0 Not Useful 0