When they require assistance from the device model, x86 HVM guests
must be temporarily de-scheduled. The device model will signal Xen
when it has completed its operation, via an event channel, so that the
relevant vCPU is rescheduled.
If the device model were to signal Xen without having actually
completed the operation, the de-schedule / re-schedule cycle would
repeat. If, in addition, Xen is resignalled very quickly, the
re-schedule may occur before the de-schedule was fully complete,
triggering a shortcut. This potentially repeating process uses
ordinary recursive function calls, so could result a stack overflow.
Created xen tracking bugs for this issue:
Affects: fedora-all [bug 1908085]
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.