Sergey Dyasli

**Name of the Vulnerable Software and Affected Versions** Xen versions prior to 4.12 **Description** The issue is related to an incompatibility between Process Context Identifiers (PCID) and TLB flushes, allowing x86 PV guest OS users to cause a denial of service or gain privileges. This is due to insufficient input validation in the Xen hypervisor. **Recommendations** For Xen versions prior to 4.12, update to version 4.12 or later to resolve the issue. At the moment, there is no information about other versions that contain a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Xen versions 4.9.x through 4.11.x Description: An issue in Xen on Intel x86 platforms allows x86 HVM and PVH guests to cause a host OS denial of service or possibly have other impact due to improper restriction of nested VT-x, leading to a NULL pointer dereference. The vulnerability can be exploited to cause a denial of service. Recommendations: For Xen versions 4.9.x through 4.11.x, consider restricting the use of nested VT-x to minimize the risk of exploitation until a patch is available. As a temporary workaround, limiting the functionality of x86 HVM and PVH guests may help reduce the risk of a denial of service. At the moment, there is no information about a newer version that contains a fix for this vulnerability.