Re: [PATCH v4 1/3] balloon: add Security Considerations section

On Thu, May 7, 2026 at 10:52=E2=80=AFAM Michael S. Tsirkin <[email protected]>=
 wrote:
>
> Add Security Considerations covering information leakage (balloon
> pages may contain sensitive data), free page reporting exposure,
> and denial of service (malicious num_pages).
>
> Signed-off-by: Michael S. Tsirkin <[email protected]>
> ---

Reviewed-by: Manos Pitsidianakis <[email protected]>

>  device-types/balloon/description.tex | 28 ++++++++++++++++++++++++++++
>  1 file changed, 28 insertions(+)
>
> diff --git a/device-types/balloon/description.tex b/device-types/balloon/=
description.tex
> index a1d9603..a2e4a37 100644
> --- a/device-types/balloon/description.tex
> +++ b/device-types/balloon/description.tex
> @@ -632,3 +632,31 @@ \subsubsection{Free Page Reporting}\label{sec:Device=
 Types / Memory Balloon Devi
>  If the VIRTIO_BALLOON_F_PAGE_POISON feature has been negotiated, the dev=
ice
>  MUST NOT modify the the content of a reported page to a value other than
>  \field{poison_val}.
> +
> +\subsection{Security Considerations}\label{sec:Device Types / Memory Bal=
loon Device / Security Considerations}
> +
> +In environments where the device is not trusted, such as
> +confidential computing, the balloon device presents several
> +security concerns.
> +
> +\subsubsection{Information Leakage}\label{sec:Device Types / Memory Ball=
oon Device / Security Considerations / Information Leakage}
> +
> +When the driver inflates the balloon, the addresses of the pages
> +are communicated to the device. On some systems, the page contents
> +themselves are also accessible to the device. These pages may
> +contain sensitive data from previous use by the guest. In systems
> +where the device is untrusted, the driver should sanitize pages
> +before inflating them.
> +
> +Free page hinting and free page reporting similarly expose
> +information about which pages are free, and in the case of
> +reporting, may make page contents accessible to the device. Memory
> +statistics reporting exposes guest memory usage patterns.
> +
> +\subsubsection{Denial of Service}\label{sec:Device Types / Memory Balloo=
n Device / Security Considerations / Denial of Service}
> +
> +A malicious device could set \field{num_pages} to an
> +unreasonably large value, causing the driver to surrender most
> +of the guest's memory. Drivers should apply reasonable limits
> +and not inflate the balloon to the point where the guest
> +becomes unable to function.
> --
> MST
>
>