Race Condition

Xen is vulnerable to Race Condition. The vulnerability is caused due to the two mitigations XSA-422 (Branch Type Confusion) and XSA-434 (Speculative Return Stack Overflow) not active (because it was believed that the mitigations always operated in contexts with IRQs disabled) due to original XSA-254 fix for Meltdown (XPTI) deliberately left interrupts enabled on two entry paths; one unconditionally, and one conditionally on whether XPTI was active. This can lead to a malicious PV guest bypass BTC/SRSO protections and launch a BTC/SRSO attack.