Xen 3.3.x-4.5.x and Linux kernel through 3.19.1 - PCI command register access for assigned devices: A tenant clears the

Impact

A tenant clears the memory- or I/O-decode bit in the PCI command register of its assigned device and then touches the device's BAR. The transaction gets an Unsupported Request completion, the platform raises a fatal NMI, and the host dies with every co-tenant on it. What makes this one worth carrying is the scope line - it is not a Xen-only bug. The same unmediated command-register write existed in the Linux kernel's own device-assignment path through 3.19.1, so KVM/VFIO GPU passthrough hosts were affected too, and that is the configuration most GPU clouds actually run.

Who can reach it

Guest administrator with any assigned PCI device, on either Xen or KVM/VFIO. Two config-space writes and one MMIO read.

What to do

Update Xen per XSA-120 and the Linux kernel past 3.19.1 (the VFIO side gained emulation of the command register rather than passing writes through), then reboot the hosts. Firmware matters here as much as software: whether a UR turns into a fatal NMI or is logged and swallowed is a platform/BIOS AER configuration choice, so validate the behaviour per server model. Track CVE-2015-8553 with it - same advisory family, and that one leaks uninitialised host memory rather than crashing.

References