CVE-2020-15565: 
NixOS vulnerability analysis and mitigation

CVE-2020-15565 is a vulnerability in the Xen hypervisor discovered by Roger Pau Monné of Citrix and publicly disclosed on July 7, 2020. The vulnerability affects Xen versions from at least 3.2 onwards and is specifically related to insufficient cache write-back under VT-d when page tables are shared between IOMMU and CPU (Xen Advisory).

The vulnerability occurs when page tables are shared between IOMMU and CPU, where changes require flushing of both TLBs. In non-coherent IOMMUs, the CPU cache needs to be written back to memory before flushing IOMMU TLBs after changes are made. This write-back operation was missing specifically when splitting large page mappings into smaller granularity ones. The issue only affects x86 Intel systems, while x86 AMD and Arm systems are not affected. The vulnerability can only be exploited by x86 HVM guests using hardware assisted paging (HAP), having a passed through PCI device assigned, and having page table sharing enabled (Xen Advisory).

A malicious guest may be able to retain read/write DMA access to frames returned to Xen's free pool, which could later be reused for another purpose. The vulnerability could potentially lead to host crashes (resulting in Denial of Service) and privilege escalation cannot be ruled out (Xen Advisory).

The vulnerability requires specific conditions to be exploitable: the system must be running on x86 Intel hardware, using HVM guests with hardware assisted paging, have PCI device passthrough enabled, and page table sharing must be enabled. Page table sharing is enabled by default only if Xen considers IOMMU and CPU large page size support compatible (Xen Advisory).

Several mitigation options are available: 1) Suppress the use of page table sharing using the command line option 'iommu=no-sharept' (note that for Xen version 4.13 there's also a per-guest control using the 'passthrough=' libxl guest config file option), 2) Suppress the use of large HAP pages using command line options 'hap_2mb=no hap_1gb=no', or 3) Disable PCI device passthrough to HVM guests. Additionally, patches have been released for various Xen versions from 4.9.x through 4.13.x (Xen Advisory).