Xen through 4.12.x - passed-through PCI devices left able to DMA into host memory after being handed to an untrusted

Impact

A guest that has been assigned a physical device gains host privileges through DMA, because the device retains reach into memory it should have lost. For a GPU-passthrough cloud this is the direct form of the failure everyone worries about: the tenant you gave a GPU to uses that GPU to read and write the hypervisor. It also breaks tenant handoff, since the state that makes the device dangerous is set up around assignment and de-assignment - the exact transition that happens between customers.

Who can reach it

A tenant in a guest domain with a physical device assigned to it. That is the normal configuration of a GPU-passthrough product, not an unusual one.

What to do

Patch Xen (XSA-302) and reboot the hypervisor - a rolling drain across the fleet. Structurally, use the assignable-add workflow so devices are explicitly quarantined before and after assignment rather than being handed straight from host to guest. Beyond this specific CVE, the general lesson holds for every passthrough platform including KVM/VFIO: reset the device, flush its DMA mappings and re-verify its firmware between tenants, and treat 'the device was assigned to someone else five minutes ago' as untrusted state.

References