Xen on x86 - speculative vulnerabilities with bare 32-bit PV guests: Bare (non-shim) 32-bit PV guests run in ring 1, an

Impact

Bare (non-shim) 32-bit PV guests run in ring 1, an arrangement that leaves them exposed to speculative-execution attacks against the hypervisor and other guests. Listed here because the mitigation story on AMD hardware differs from Intel's and gets overlooked - if you still run 32-bit PV guests anywhere, this is a standing cross-guest speculative exposure.

Who can reach it

From inside a 32-bit PV guest.

What to do

Fixed in Xen (XSA-370) by running 32-bit PV guests under the PV shim rather than bare. Update Xen, switch affected guests to shim mode, and reboot. The durable answer is to stop running 32-bit PV guests at all - on a modern AI fleet there is no reason to have any.

References

Related entries

• Linux kernel (drivers/iommu/amd): On AMD hosts, switching a device's IOMMU group between a DMA domain and an identityCVE-2021-47140 · Linux kernel (drivers/iommu/amd)Medium
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A race condition or locking defect in the amdkfd (KFDCVE-2021-47410 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)Medium
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A memory or reference-count leak in the amdkfd (KFDCVE-2021-47420 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)Medium
• util-linux (chfn/chsh): Partial disclosure of arbitrary files via libreadline in setuid chfn/chshCVE-2022-0563 · util-linux (chfn/chsh)Medium
• KVM: NULL pointer dereference in kvm_irq_delivery_to_apic_fast() - guest crashes the hostCVE-2022-2153 · KVMMedium
• Linux kernel (mm anon_vma): Use-after-free from leaf anon_vma double reuse - memory corruption / privesc primitiveCVE-2022-42703 · Linux kernel (mm anon_vma)Medium