Field Notes

source

Xen isolation failures affecting Qubes OS

StatusStableUpdatedStands on2 sourcesSupportsnotes

Qubes Security Bulletin #29. Project Zero, Pandavirtualization.

Two documents from April 2017 recording a Xen bug that broke Qubes OS’s central security guarantee, paired because one is the exploit and the other is the affected project’s own assessment of it.

What the bug was

Jann Horn of Project Zero reported a flaw in Xen’s paravirtualization (PV) memory handling, issued as XSA-212. Xen’s access_ok() checks only the start address of a guest buffer, relying on non-canonical addresses to fault before a sequential read reaches hypervisor memory. The XENMEM_exchange hypercall lets the caller choose where in the array processing begins, which defeats that assumption and permits reads and writes into Xen’s own memory.

Horn’s proof of concept is the part worth remembering: executed in one 64-bit PV guest with root privileges, it “will execute a shell command as root in all other 64-bit PV guests (including dom0) on the same physical machine.”

What Qubes said about it

The bulletin does not minimize the result:

That sentence describes the exact chain compartmentalization is meant to prevent: an application exploit in one qube escalating to the whole machine. The bulletin also recalls XSA-148 from October 2015, which it calls infamous and says “regrettably did affect Qubes OS.”

The architectural response

Qubes attributes the class to PV itself — “another bug resulting from the overly-complex memory virtualization required for PV in Xen” — and used it to justify a change already planned for Qubes 4.0: dropping PV for hardware-enforced memory virtualization using second level address translation (SLAT), called EPT on Intel, and requiring SLAT support on all certified hardware.

This matters for how the two documents should be cited. They are evidence that Xen’s isolation has failed in practice and that Qubes was affected, not evidence about the attack surface Qubes presents today, because the subsystem exploited here is one the project subsequently removed.

What the change did was move the guarantee’s foundation from Xen’s software into the processor. Qubes OS Security in the Public Record measures where the burden landed: transient-execution and microcode issues account for 23 of 73 post-2018 bulletins. The trade was a patchable attack surface for one that is not fully fixable in software, which is a defensible engineering decision and not the elimination of the risk.

Built on 2 sources (2 external).

Working out connections…