An issue was discovered in Xen through 4.14.x. There are missing memory barriers when accessing/allocating an event channel. Event channels control structures can be accessed lockless as long as the port is considered to be valid. Such a sequence is missing an appropriate memory barrier (e.g., smp_*mb()) to prevent both the compiler and CPU from re-ordering access. A malicious guest may be able to cause a hypervisor crash resulting in a Denial of Service (DoS). Information leak and privilege escalation cannot be excluded. Systems running all versions of Xen are affected. Whether a system is vulnerable will depend on the CPU and compiler used to build Xen. For all systems, the presence and the scope of the vulnerability depend on the precise re-ordering performed by the compiler used to build Xen. We have not been able to survey compilers; consequently we cannot say which compiler(s) might produce vulnerable code (with which code generation options). GCC documentation clearly suggests that re-ordering is possible. Arm systems will also be vulnerable if the CPU is able to re-order memory access. Please consult your CPU vendor. x86 systems are only vulnerable if a compiler performs re-ordering.
NVD Severity
Other trackers
Mailing lists
GitHub (code, issues), Aports (code, issues)


Type URI
Third Party Advisory
Third Party Advisory
Third Party Advisory
Third Party Advisory

Match rules

CPE URI Source package Min version Max version
cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:* xen >= None <= 4.14.0

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
xen 3.10-main 4.12.4-r0 None fixed
xen 3.12-main 4.13.4-r0 Natanael Copa <> fixed
xen 3.11-main 4.13.4-r0 Natanael Copa <> fixed