>There are two angles to consider for this question: >Can an untrusted guest attack the hypervisor using Meltdown or Spectre? >Can a guest user-space program

>There are two angles to consider for this question: >Can an untrusted guest attack the hypervisor using Meltdown or Spectre? >Can a guest user-space program attack a guest kernel using Meltdown or Spectre? There are two angles if you maintain Xen yourself. However the vast majority of people aren't Xen customers, they are customers of Amazon or other cloud provider. In which case the main concern is: Can a fellow customer guest running on an AWS instance attack my guest account? It seems like the answer is "No", but it looks like the answer might be "Only if dom0 is patched", and might even be "Yes". Since it's not in AWS interests to publicize that the answer is Yes, and since AWS is a large user of Xen, I find the it unsettling that this question is unanswered. It makes me thing it is unanswered for a reason. And if the response is "Oh, we didn't think about it from that perspective", then that would be even more disturbing.