Xen, when running on a 64-bit hypervisor, allows local x86 guest OS users to modify arbitrary memory and consequently obtain sensitive information, cause a denial of service (host crash), or execute arbitrary code on the host by leveraging broken emulation of bit test instructions.
https://support.citrix.com/article/CTX218775
https://security.gentoo.org/glsa/201612-56
http://xenbits.xen.org/xsa/advisory-195.html