The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was later
re-worked to better integrate with other manipulations of the same MSR.
In this rework an inverted conditional was introduced, resulting in the
workaround to not be applied when needed and vice versa.
For more details, see:
http://xenbits.xen.org/xsa/advisory-433.html
Xen versions 4.19.4 and onwards, 4.20.3 and onwards, 4.21.1 and onwards,
and 4.22 are affected. Xen versions 4.18, minor versions 4.19.3 and
earlier, minor versions 4.20.2 and earlier, and 4.21.0 are not affected.
The vulnerability can only be leveraged on systems running out-of-date
microcode. Microcode fixing Zenbleed was published in late 2023.
Updated firmware subseqeuent to this, or e.g. updated amd-ucode from
linux-firmware (for the subset of CPUs covered by linux-firmware) are
not vulnerable.
The original issue and hence the applicability of the workaround is
specific to the AMD Zen2 microarchitecture. AMD do not believe that
other microarchitectures are affected.
This issue can be mitigated by disabling AVX, either by booting Xen with
cpuid=no-avx on the command line, or by specifying cpuid="host:avx=0" in
the vm.cfg file of all untrusted VMs. However, this will come with a
significant impact on the system and is not recommended for anyone able to
deploy the microcode or patch described below.