A vulnerability in the Xen libxl component allows unauthorized access to 64-bit memory BARs after a PCI device is detached, posing a significant risk to domain isolation.

The vulnerability stems from flawed detach logic in the libxl library, which fails to remove access permissions for 64-bit memory Base Address Registers (BARs) during PCI device detachment. This allows a domain to retain unauthorized access to memory regions that should have been restricted.

This flaw undermines the fundamental security boundary of the Xen hypervisor by enabling unauthorized memory access between domains. Given a CVSS score of 7.5, the risk of data compromise is high, as an attacker could potentially gain access to sensitive information residing in leaked memory regions. This could lead to a breach of confidentiality and loss of trust in the virtualized environment.

Immediate Action: Review the official Xen Project security advisory (XSA-476) and apply the necessary patches provided by your distribution vendor as soon as they become available.

Proactive Monitoring: Monitor hypervisor logs for any unexpected attempts to access memory regions or PCI configuration spaces following device detachment events.

Compensating Controls: Ensure strict hardware passthrough policies are enforced and limit the assignment of PCI devices to untrusted domains until the patch is applied.

Public Exploit Available: Unknown

The inability to properly revoke memory access permissions after a device is detached represents a critical failure in domain isolation. Xen administrators should prioritize the deployment of vendor-supplied updates to rectify this logic error. Until patching is complete, minimize the dynamic reassignment of PCI devices to reduce the window of exposure.