CVE-2020-25601

A security flaw was found in Xen. A lack of preemption in the FIFO event channel model may cause the CPU to spend an almost unbounded amount of processing time. This flaw allows malicious or buggy guest kernels to mount a denial of service (DoS) attack affecting the entire system. The highest threat from this vulnerability is to system availability.

Mitigation

This issue can be avoided by reducing the number of event channels available to all guests to a suitably low limit. For example, setting "max_event_channels=256" in the xl domain configurations may be low enough for all hardware Xen is able to run on.