CVE-2021-3308: 
NixOS vulnerability analysis and mitigation

CVE-2021-3308 was discovered in Xen versions 4.12.3 through 4.12.4 and 4.13.1 through 4.14.x, disclosed on January 26, 2021. The vulnerability affects x86 systems running HVM guests with PCI pass-through devices. The issue was discovered by James McCoy, debugged with Samuel Verschelde of Vates, and recognized as a security issue by Roger Pau Monné of Citrix (Xen Advisory).

The vulnerability allows an x86 HVM guest with PCI pass-through devices to force the allocation of all IDT vectors on the system by rebooting itself with MSI or MSI-X capabilities enabled and entries setup. Such reboots leak vectors used by the MSI(-X) entries, leading to vector exhaustion on the system, preventing further PCI pass-through devices from working properly. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (Medium) with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability enables HVM guests with PCI pass-through devices to mount a Denial of Service (DoS) attack affecting the pass-through of PCI devices to other guests or the hardware domain. When affecting the hardware domain, the impact extends to the entire host. Even non-malicious guests can trigger this vulnerability during normal operation (Xen Advisory).

The vulnerability can be exploited by any HVM guest with PCI pass-through devices. The attack vector requires local access with privileged code execution capabilities in a guest VM. The vulnerability was reported and debugged publicly before its security implications were apparent (Xen Advisory).

The primary mitigation is to not run HVM guests with PCI pass-through devices. For a permanent fix, system administrators should apply the appropriate patches provided by Xen or upgrade to fixed versions. Patches were prepared for the stable branches, and downstream users are encouraged to update to the tip of the stable branch before applying these patches (Xen Advisory).