xen-kernel -- x86 segment base write emulation lacking canonical address checks

The Xen Project reports:

Both writes to the FS and GS register base MSRs as well as the WRFSBASE and WRGSBASE instructions require their input values to be canonical, or a #GP fault will be raised. When the use of those instructions by the hypervisor was enabled, the previous guard against #GP faults (having recovery code attached) was accidentally removed.

A malicious guest administrator can crash the host, leading to a DoS.

[source]