The acceleration support for the \REP MOVS\ instruction in Xen 4.4.x 3.2.x and earlier lacks properly bounds checking for memory mapped I/O (MMIO) emulated in the hypervisor which allows local HVM guests to cause a denial of service (host crash) via unspecified vectors.