阿里云漏洞库

The current setup of the quarantine page tables assumes that the

quarantine domain (dom_io) has been initialized with an address width

of DEFAULT_DOMAIN_ADDRESS_WIDTH (48) and hence 4 page table levels.

However dom_io being a PV domain gets the AMD-Vi IOMMU page tables

levels based on the maximum (hot pluggable) RAM address, and hence on

systems with no RAM above the 512GB mark only 3 page-table levels are

configured in the IOMMU.

On systems without RAM above the 512GB boundary

amd_iommu_quarantine_init() will setup page tables for the scratch

page with 4 levels, while the IOMMU will be configured to use 3 levels

only, resulting in the last page table directory (PDE) effectively

becoming a page table entry (PTE), and hence a device in quarantine

mode gaining write access to the page destined to be a PDE.

Due to this page table level mismatch, the sink page the device gets

read/write access to is no longer cleared between device assignment,

possibly leading to data leaks.

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
https://xenbits.xenproject.org/xsa/advisory-445.html

CWE-ID	漏洞类型
NVD-CWE-noinfo