Xen security (or lack thereof)

Interesting paper by Tavis Ormandy (of Gentoo/Google fame) about the security of various virtualization products; one of the conclusions is that Xen is secure as long as hardware virtualization is not used: Xen's HVM mode uses a QEMU-based emulator to provide emulated devices, and is thus probably vulnerable to QEMU's many security flaws... To make matters worse, this emulator (xen-ioemu) runs in dom0 with ring0 privileges.

I don't use Xen's HVM mode even on hardware that supports it but if I did, I'd be migrating my domains away from it right now. And since QEMU is used in quite a few similar products (KVM, anyone?), this is probably just the start of a long series of headaches.