Igor Druzhinin

**Name of the Vulnerable Software and Affected Versions** Xen (affected versions not specified) **Description** The issue is related to inappropriate x86 IOMMU timeout detection and handling. IOMMUs process commands in parallel with the operation of the CPU(s) issuing such commands. In the current implementation in Xen, asynchronous notification of the completion of such commands is not used, and the issuing CPU spin-waits for the completion of the most recently issued command(s). Some of these waiting loops try to apply a timeout to fail overly-slow commands. However, the course of action upon a perceived timeout actually being detected is inappropriate, potentially causing guests to be marked as crashed on Intel hardware or higher layer callers to continue as if the IOMMU operation succeeded on AMD hardware. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Xen versions prior to 4.14.x **Description** A race condition exists when migrating timers between x86 HVM vCPUs, potentially causing a hang or crash of the hypervisor, resulting in a Denial of Service (DoS). The issue is specific to x86 systems and can only be leveraged by x86 HVM guests with more than one vCPU. **Recommendations** For Xen versions prior to 4.14.x, consider restricting the use of multiple vCPUs for x86 HVM guests to minimize the risk of exploitation until a patch is available. As a temporary workaround, limiting the number of vCPUs for affected guests may help mitigate the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Xen versions 4.8.x through 4.11.x **Description** The issue allows x86 PV guest OS users to cause a denial of service due to mishandling of failed IOMMU operations, which causes a bug check during the cleanup of a crashed guest. This is a result of insufficient input validation, enabling an attacker to exploit the issue and cause a denial of service. **Recommendations** For Xen versions 4.8.x through 4.11.x, at the moment, there is no information about a newer version that contains a fix for this vulnerability.