CVE-2013-3495
http://xenbits.xen.org/xsa/advisory-59.html
Intel VT-d Interrupt Remapping engines can be evaded by native NMI interrupts
Message Signaled Interrupts (MSI) interrupts on Intel platforms are defined as DWORD writes to a special address location (0xFEE?????). MSIs on Intel Platforms supporting VT-d have two defined formats - Remappable format interrupts, and Compatibility (not remappable) format interrupts, based on the format of their data payload. Remappable interrupts are subject to interrupt-remapping protection checks, while compatibility format interrupts are not. For protection reasons, host software disables compatibility format interrupts (causing them to be blocked by interrupt translation hardware) and manages the remappable interrupts through programming of interrupt-remapping table entries.
Malformed MSIs are transactions to the special (0xFEE?????) address range that do not have proper attributes of MSI requests (e.g., size of request is invalid). Such malformed transactions are detected and aborted by the platform, before they are subject to further interrupt remapping/processing. For RAS purposes, some platforms may be configured to support System Error Reporting (SERR) capability. These platforms raise a PCI system error (SERR#) due to Unsupported Request, which are typically delivered as Non-Maskable Interrupts (NMI), to report such errors to software. Depending on hypervisor and Dom0 kernel configuration, such an NMI may be handled by the hypervisor/Dom0 or can result in a host software halt (
panic). On platforms with SERR enabled, such malformed MSI requests can be generated by guest OS with an assigned device, causing hypervisor/Dom0 receive NMI despite using VT-d and interrupt remapping for device assignment.
MSI有两种格式：remappable and compatibitlity (not remappable). 前者由interrupt-remapping保护机制进行保护，后者没有。因此host一般会禁止compatibility的MSI，并通过interrupt-remapping table entries对remappable interrupt进行管理
malformed MSI是那些包含非法请求的向特殊地址段（0xFEE?????）发起的事务。这些请求一般会在交给interrupt-remapping保护机制进行处理之前被监测到，并禁止。一些平台会在遇到这些非法请求的时候raise一个PCI system error（SERR#），其会被作为一个NMI被交给hypervisor/dom0处理。根据hypervisor/dom0的配置不同，这些NMI可能被正常处理，也可能造成host panic。
improper error handling (unecessary host panic)
No
A malicious domain, given access to a device which bus mastering capable, can mount a denial of service attack affecting the whole system.
DoS