CVE-2020-15563: 
NixOS vulnerability analysis and mitigation

An inverted conditional vulnerability was discovered in Xen versions 4.8 through 4.13.x, identified as CVE-2020-15563. The vulnerability affects x86 HVM guests' dirty video RAM tracking code, allowing guests to make Xen dereference a pointer that points to unmapped space. This issue was discovered by Jan Beulich of SUSE and was publicly disclosed on July 7, 2020 (Xen Advisory).

The vulnerability specifically affects x86 systems running HVM guests that use shadow paging. For the vulnerability to be exploitable, there needs to be an entity actively monitoring a guest's video frame buffer, typically for display purposes. The issue does not affect Arm systems, x86 PV guests, or x86 HVM guests using hardware assisted paging (HAP) (Xen Advisory).

A malicious or buggy HVM guest can cause the hypervisor to crash, resulting in a Denial of Service (DoS) that affects the entire host system (Xen Advisory, Ubuntu Notice).

The vulnerability can be leveraged by x86 HVM guests using shadow paging when there is an entity actively monitoring the guest's video frame buffer. The exploitation requires specific conditions to be met, including the use of shadow paging instead of hardware assisted paging (Xen Advisory).

Several mitigation options are available: running only PV guests will avoid the vulnerability entirely, or for HVM guests explicitly configured to use shadow paging, changing to HAP (by setting 'hap=1' in the configuration) will prevent exposure to the vulnerability. HAP is the default setting in upstream Xen where hardware supports it. The vulnerability can also be resolved by applying the security patches provided (Xen Advisory).

Multiple Linux distributions released security updates to address this vulnerability, including Debian, Ubuntu, Fedora, and Gentoo. Citrix also released a security update for their Citrix Hypervisor product (Debian Notice, Citrix Update).