When XSAVE/XRSTOR are not in use by Xen to manage guest extended
register state, the initial values in the FPU stack and XMM registers
seen by the guest upon first use are those left there by the previous
user of those registers.
A malicious domain may be able to leverage this to obtain sensitive
information such as cryptographic keys from another domain.
All Xen versions are vulnerable.
Only x86 systems without XSAVE support or with XSAVE support disabled
ARM systems are not vulnerable.
On XSAVE capable systems, not turning off XSAVE support via the
"no-xsave" hypervisor command line option (or - when defaulting to
off - turning it on via the "xsave" hypervisor command line option)
will avoid the vulnerability. To find out whether XSAVE is in use,
consult the hypervisor log (obtainable e.g. via "xl dmesg") and look
for a message of the form
"xstate_init: using cntxt_size: <number> and states: <number>"
If such a message is present then XSAVE is in use. But note that due
to log buffer size restrictions this boot time message may have
There is no known mitigation on XSAVE-incapable systems.
Red Hat would like to thank the Xen project for reporting this issue.
Created xen tracking bugs for this issue:
Affects: fedora-all [bug 1292439]
xen-4.5.2-6.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
xen-4.5.2-6.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.