Tim Deegan

**Name of the Vulnerable Software and Affected Versions** Xen (affected versions not specified) **Description** The issue arises when PV guests are run in shadow paging mode to work around kernels unaware of L1TF. In this mode, Xen and shadowed PV guests run directly on the respective shadow page tables. For 64-bit PV guests, this means running on the shadow of the guest root page table. When dealing with a shortage of memory in the shadow pool associated with a domain, shadows of page tables may be torn down, including the shadow root page table that the CPU is presently running on. A precaution exists to prevent the tearing down of the underlying live page table, but the time window covered by this precaution is not large enough. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Xen versions 4.3.x and earlier **Description** The issue arises from improper error handling, allowing local HVM guests to access hypervisor stack memory through various operations, including port or memory mapped I/O writes, or other unspecified address-related operations without associated memory. **Recommendations** For versions 4.3.x and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Xen versions prior to 4.1.1 **Description** The issue allows local guest OS kernels with control of a PCI[E] device to cause a denial of service, resulting in CPU consumption and host hang. This is achieved by sending many crafted DMA requests that are denied by the IOMMU, triggering a livelock. **Recommendations** For versions prior to 4.1.1, update to a version that contains a fix for this issue to prevent local guest OS kernels from causing a denial of service.