x86 task switch to VM86 mode mis-handled

ISSUE DESCRIPTION

LDTR, just like TR, is purely a protected mode facility. Hence even when switching to a VM86 mode task, LDTR loading needs to follow protected mode semantics. This was violated by the code.

IMPACT

On SVM (AMD hardware): a malicious unprivileged guest process can escalate its privilege to that of the guest operating system.
On both SVM and VMX (Intel hardware): a malicious unprivileged guest process can crash the guest.

VULNERABLE SYSTEMS

Only 32-bit x86 HVM guests are vulnerable. Furthermore, only guest operating systems which actually make use of hardware task switching, and allow a new task to start in VM86 mode, are vulnerable. We are not aware of any such operating systems.
The vulnerability is NOT exposed on any PV guests. The vulnerability is NOT exposed on any 64-bit guests,
ARM systems are NOT vulnerable.
Xen versions from 4.0 onwards are affected. Xen versions 3.4 and earlier are not affected.