Xen 3.1.1 does not prevent modification of the CR4 TSC from applications, which allows pv guests to cause a denial of service (crash).

More... (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5907)