Xen on AMD-Vi (AMD IOMMU) - ACPI IVMD unity-map page permissions: Xen honours ACPI-described IOMMU unity mappings but

Impact

Xen honours ACPI-described IOMMU unity mappings but applied page permissions inconsistently, so a passed-through device can end up with wider DMA access than the hypervisor intended. On a GPU cloud that does device passthrough, this is the boundary that stops one tenant's assigned accelerator from DMA-ing into another guest's memory - and it was not holding.

Who can reach it

Requires a guest with a passed-through PCI device, which on a GPU cloud is the standard configuration. The malicious guest drives DMA from its own assigned device.

What to do

Fixed in Xen via XSA-378. Update the hypervisor and reboot the host; no firmware step. If you run GPU passthrough on Xen, this is a top-priority class - the whole security model of passthrough rests on the IOMMU restricting device DMA correctly.

References