CVE-2020-29487: 
Linux Gentoo vulnerability analysis and mitigation

An issue was discovered in Xen XAPI before 2020-12-15. The vulnerability (CVE-2020-29487) affects the xenstore key watching functionality in the XAPI toolstack. The issue involves xenopsd watching certain xenstore keys that provide feedback from the guest, with data being forwarded via RPC through message-switch to xapi (XEN Advisory).

The vulnerability stems from watching logic in xenopsd that sends one RPC update containing all data whenever any single xenstore key is updated, resulting in O(N^2) time complexity. Additionally, message-switch retains recent (128) RPC messages for diagnostic purposes, leading to O(M*N) space complexity. The amount of memory a single guest can monopolize is bounded by xenstored quota, which is estimated to exceed 1G per malicious guest (XEN Advisory).

The vulnerability can manifest as a host denial of service, either through message-switch thrashing against swap or complete OOM (Out of Memory) condition, depending on dom0's configuration. A buggy or malicious guest can cause unreasonable memory usage in dom0, resulting in a host-wide denial of service (XEN Advisory).

The vulnerability can be exploited by any guest with the ability to modify xenstore keys. All versions of XAPI are vulnerable, though systems not using the XAPI toolstack are not affected. The issue was discovered by Edwin Török of Citrix (XEN Advisory).

No mitigations were available before the patch. The issue was resolved through a series of patches that introduce quotas in xenopsd to limit the quantity of keys which result in RPC traffic. Users should upgrade to patched versions of the software (XEN Advisory, Gentoo Advisory).