VMFUNC emulation in Xen 4.6.x through 4.8.x on x86 systems using AMD virtualization extensions (aka SVM) allows local HVM guest OS users to cause a denial of service (hypervisor crash) by leveraging a missing NULL pointer check.
https://support.citrix.com/article/CTX219378
http://xenbits.xen.org/xsa/advisory-203.html