title: x86: BTC/SRSO fixes not fully effective
description: The fixes for XSA-422 (Branch Type Confusion) and XSA-434 (Speculative
Return Stack Overflow) are not IRQ-safe.  It was believed that the
mitigations always operated in contexts with IRQs disabled.
However, the original XSA-254 fix for Meltdown (XPTI) deliberately left
interrupts enabled on two entry paths; one unconditionally, and one
conditionally on whether XPTI was active.
As BTC/SRSO and Meltdown affect different CPU vendors, the mitigations
are not active together by default.  Therefore, there is a race
condition whereby a malicious PV guest can bypass BTC/SRSO protections
and launch a BTC/SRSO attack against Xen.
affected:
{
defaultStatus: unknown
product: Xen
vendor: Xen
versions:
status: unknown, version: consult Xen advisory XSA-446
}
workarounds: Running only HVM or PVH VMs will avoid the vulnerability.