Xen on AMD - debug extensions (DBEXT) exposure to guests: AMD CPUs since roughly 2014 carry extensions to x86 debugging

Impact

AMD CPUs since roughly 2014 carry extensions to x86 debugging that Xen exposed to guests without properly managing the associated MSR state across context switches. A guest can use debug facilities to observe or interfere with state belonging to another context - debug hardware is designed to see everything, which is precisely why leaking it across a VM boundary matters.

Who can reach it

From inside a guest VM on AMD hardware under Xen.

What to do

Fixed in Xen (XSA-444). Update the hypervisor and reboot the host.

References

Related entries

• Xen on AMD - debug extensions (DBEXT) exposure to guests: Companion to the other XSA-444 debug-extension issue on AMD.CVE-2023-34328 · Xen on AMD - debug extensions (DBEXT) exposure to guestsMedium
• Arm Mali GPU kernel driver: Use-after-free via improper GPU memory processingCVE-2023-4211 · Arm Mali GPU kernel driverMedium
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A race condition or locking defect in the amdkfd (KFDCVE-2023-52632 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)Medium
• Linux kernel BPF verifier: stack bound arithmetic done in 32 bits could overflowCVE-2023-52676 · Linux kernel BPF verifier (stack bounds arithmetic in kernel/bpf/verifier.c)Medium
• Linux kernel (net/tls): Sendfile() on a kTLS socket whose plaintext and ciphertext buffers are both empty drives theCVE-2023-52767 · Linux kernel (net/tls)Medium
• Linux cpufreq/amd-pstate-ut - kernel panic when loading the unit-test driver: Loading the amd-pstate unit-test moduleCVE-2023-53563 · Linux cpufreq/amd-pstate-ut - kernel panic when loading the unit-test driverMedium