A guest started with Populated on Demand enabled (PoD) can attempt to reclaim pages which aren't regular guest RAM. This can cause corruption of memory management state in Xen.
Parts of the DMOP handling code assumes the caller has provided the required number of buffers for the given operation without any checking being done. As a result, certain operations might access stack rubble as structures are possibly uninitialized.
Accessing the vNUMA configuration data of a guest is still possible when domain destruction has already started. The cleaning up of that configuration information is not synchronized with its retrieval by a device model controlling the guest.
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]
To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these operations may not be executed in parallel, so a system-wide lock each is used. The way those locks are acquired is, however, not providing any fairness. Furthermore, with XSM/Flask in use, the lock acquire will, for some operations, occur ahead of any permission checking.
The sysctl issue is CVE-2026-62426.
The platform-op issue is CVE-2026-62427.
Xenstore, to have an up-to-date picture of the entire system, wants to know of domains appearing and disappearing. To make this more robust, a new XENDOMCTLgetdomainstate was introduced. The management of the bitmap underlying that operation is tied into the binding of the VIRQDOMEXC virtual IRQ. Unfortunately an error path there would tear down the bitmap even in cases when it wasn't set up. Unprivileged domains can trigger that error path.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
Xen Security Advisory XSA-508 version 2
pygrub is only supported in de-privileged mode
UPDATES IN VERSION 2 ====================
Public release.
ISSUE DESCRIPTION =================
XSA-443 and XSA-497 addressed specific issues in specific file system drivers (libfsimage) used by pygrub. Further issues were reported, and yet more are to be expected. XSA-443 introduced a means to run pygrub de-privileged. Only this mode of operation is security supported from now on.
IMPACT ======
A guest using pygrub can escalate its privilege to that of the domain construction tools (i.e., normally, to control of the host).
VULNERABLE SYSTEMS ==================
All Xen versions from at least 3.2 onwards are affected. Older versions have not been inspected.
MITIGATION ==========
XSA-443 added a mechanism to run pygrub de-privileged. Using this mode will mitigate the vulnerability.
Ensuring that guests do not use the pygrub bootloader will avoid this vulnerability.
For cases where the PV guest is known to be 64bit, and uses grub2 as a bootloader, pvgrub is a suitable alternative to pygrub.
Running only HVM or PVH guests will avoid the vulnerability.
RESOLUTION ==========
Applying the attached patch documents this issue. Patches for XSA-443 added additional functionality to pygrub and libxl in order to run pygrub in a restricted environment using a specific UID. Check xl.cfg man page for information on the bootloaderrestrict option.
Note that patches for released versions are generally prepared to apply to the stable branches, and may not apply cleanly to the most recent release tarball. Downstreams are encouraged to update to the tip of the stable branch before applying these patches.
xsa508.patch xen-unstable - Xen 4.17.x
$ sha256sum xsa508 f1e4b6490228b7fac61fd968229f98a3dfb782d56c6729d3fe01bc34c77fbd5c xsa508.patch $
DEPLOYMENT DURING EMBARGO =========================
Deployment of the patches and/or mitigations described above (or others which are substantially similar) is permitted during the embargo, even on public-facing systems with untrusted guest users and administrators.
But: Distribution of updated software is prohibited (except to other members of the predisclosure list).
Predisclosure list members who wish to deploy significantly different patches and/or mitigations, please contact the Xen Project Security Team.
(Note: this during-embargo deployment notice is retained in post-embargo publicly released Xen Project advisories, even though it is then no longer applicable. This is to enable the community to have oversight of the Xen Project Security Team's decisionmaking.)
For more information about permissible uses of embargoed information, consult the Xen Project community's agreed Security Policy: http://www.xenproject.org/security-policy.html -----BEGIN PGP SIGNATURE-----
iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmpomsAMHHBncEB4ZW4u b3JnAAoJEIP+FMlX6CvZLhoH/38QGcVs3Xc3KuskdvBx57IV/vW9XjNlVYSngmdm lKzXTZhjrecrPZvwBbhuqOBXkaFQSL17+lLVK3xRAzv2dd5hn2PqXkMj06JSwcrh haXN/JWUDwQtmJuLfGNkQ9P1W27oMXZ3pBGhv1SsEfD0mNiyC7ZZKizU291usZbF 6JMUGNUmQ1Dyom2CiylmJGmrNrHzKdfNqURc+DoSOctpS9vbT0U0xLtKYvbVr3cj 7DuITo1/gS/3pxiUw/7E5uR7zPusBGISP1ir5rBqTkgoMf2tJkt7tfygqJtrqnkU BaUt0ZCo7NBKg71o0AESZIdO3Ddg2QD6xrymtI0BVqa0n1E= =9mkq -----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
Xen Security Advisory CVE-2026-62434 / XSA-507 version 2
PoD: Don't try to reclaim special pages
UPDATES IN VERSION 2 ====================
Public release.
ISSUE DESCRIPTION =================
A guest started with Populated on Demand enabled (PoD) can attempt to reclaim pages which aren't regular guest RAM. This can cause corruption of memory management state in Xen.
IMPACT ======
A buggy or malicious guest can cause corruption of Xen's state, leading to crashes or other malfunctions. Information leak and privilege escalation cannot be ruled out.
VULNERABLE SYSTEMS ==================
All Xen versions from 3.4 onwards are vulnerable. Xen versions 3.3 and earlier are not vulnerable.
Only x86 systems are vulnerable.
Only x86 HVM and PVH guests started in populate-on-demand mode are believed to be able to leverage the vulnerability. Populate-on-demand mode is activated when the guest's xl configuration file specifies a "maxmem" value which is larger than the "memory" value.
MITIGATION ==========
Running only PV guests or HVM/PVH guests without PoD will avoid the vulnerability.
RESOLUTION ==========
Applying the attached patch resolves this issue.
Note that patches for released versions are generally prepared to apply to the stable branches, and may not apply cleanly to the most recent release tarball. Downstreams are encouraged to update to the tip of the stable branch before applying these patches.
xsa507.patch xen-unstable - Xen 4.17.x
$ sha256sum xsa507 41485ddf0912cfa53fa05e236aa27c3c6490919ac2dab5b9f57ed69f5b38f60a xsa507.patch $
DEPLOYMENT DURING EMBARGO =========================
Deployment of the patches and/or mitigations described above (or others which are substantially similar) is permitted during the embargo, even on public-facing systems with untrusted guest users and administrators.
But: Distribution of updated software is prohibited (except to other members of the predisclosure list).
Predisclosure list members who wish to deploy significantly different patches and/or mitigations, please contact the Xen Project Security Team.
(Note: this during-embargo deployment notice is retained in post-embargo publicly released Xen Project advisories, even though it is then no longer applicable. This is to enable the community to have oversight of the Xen Project Security Team's decisionmaking.)
For more information about permissible uses of embargoed information, consult the Xen Project community's agreed Security Policy: http://www.xenproject.org/security-policy.html -----BEGIN PGP SIGNATURE-----
iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmpomr4MHHBncEB4ZW4u b3JnAAoJEIP+FMlX6CvZ+04H/i3UMWbGcPG2kp978waMmF3Gtfb/r8mw3UBzVGCi cIOBWf/FizjWu54SQEQtjwYPfi0nKftFN1UPqAGs+OUtyiZ8EcPL5x9i7arrqA2T uGfpCTb3NtFmacBbrpGnqkNahMtSLWtE8aSVEQhLxvZcLTPB6OPzIi/MVPGyA7jl /LSGWs4vd99Y8ZvAN20rhxaEAjYynfd7N4tXn38EoW9WiQBuPZ5eNzsbieah8PEo Ajntyx774ipvtYYStA4fhsLwO+6LyqH7okDR1g8Xkq6IVrOshP194mxnsuEfcMIO 4TCkWbzhmspfxQ1E2aW2VVPzIC2X2b+i8JieUK/z3mmrRSU= =AfG5 -----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
Xen Security Advisory CVE-2026-62433 / XSA-506 version 2
correct buffer checks for DMOP hypercalls
UPDATES IN VERSION 2 ====================
Public release.
ISSUE DESCRIPTION =================
Parts of the DMOP handling code assumes the caller has provided the required number of buffers for the given operation without any checking being done. As a result, certain operations might access stack rubble as structures are possibly uninitialized.
IMPACT ======
A device model of a HVM guest can gain insight on the contents of the Xen stack, thus possibly leaking data from other guests contexts.
VULNERABLE SYSTEMS ==================
All Xen versions from 4.10 onwards are vulnerable. Xen versions 4.9 and earlier are not vulnerable.
Only entities controlling HVM guests can leverage the vulnerability. These are device models running in either a stub domain or de-privileged in Dom0.
MITIGATION ==========
Running only PV or PVH guests will avoid the vulnerability.
(Switching from a device model stub domain or a de-privileged device model to a fully privileged Dom0 device model does NOT mitigate this vulnerability. Rather, it simply recategorises the vulnerability to hostile management code, regarding it "as designed"; thus it merely reclassifies these issues as "not a bug". The security of a Xen system using stub domains is still better than with a qemu-dm running as a Dom0 process. Users and vendors of stub qemu dm systems should not change their configuration to use a Dom0 QEMU process.)
RESOLUTION ==========
Applying the attached patch resolves this issue.
Note that patches for released versions are generally prepared to apply to the stable branches, and may not apply cleanly to the most recent release tarball. Downstreams are encouraged to update to the tip of the stable branch before applying these patches.
xsa506.patch xen-unstable - Xen 4.17.x
$ sha256sum xsa506 7fa79f0421eafa420f7af791ad35a96a769c945260d81419052611771347b411 xsa506.patch $
DEPLOYMENT DURING EMBARGO =========================
Deployment of the patches and/or mitigations described above (or others which are substantially similar) is permitted during the embargo, even on public-facing systems with untrusted guest users and administrators.
But: Distribution of updated software is prohibited (except to other members of the predisclosure list).
Predisclosure list members who wish to deploy significantly different patches and/or mitigations, please contact the Xen Project Security Team.
(Note: this during-embargo deployment notice is retained in post-embargo publicly released Xen Project advisories, even though it is then no longer applicable. This is to enable the community to have oversight of the Xen Project Security Team's decisionmaking.)
For more information about permissible uses of embargoed information, consult the Xen Project community's agreed Security Policy: http://www.xenproject.org/security-policy.html -----BEGIN PGP SIGNATURE-----
iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmpomrwMHHBncEB4ZW4u b3JnAAoJEIP+FMlX6CvZNF4H/0c6JMsivAWWDIQ920Bwh7EEOKhMv3nGIrBqrN8/ TGKJNNoNQinhoQv9fnqwsHaiC8e49PNUJqTpEN8/o/b0obnl4Tw2JyUXFY1bZyaz XNS85rkrUc0+Ue/Ka2464mmQ826TJXfaXG9CZYlC5cO/JtzX65ecMW4H7ju2tdnt c9xK+I5kIQPwUwy3HUMrKFvWi+JIvpCzhuHYDH2iJDecmk42pOmnKtS54q6YO15n c4xdn7aNyeECKQw4qUcjKC7zKRgrqFu5J3BlvXauZOkJCL50PK+OpWK6QV+fRNGy N7dnY5w+1BMVrHywZI5iy8WqZtJoi6TOO1Gl0WcB07/vvJk= =APkr -----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
Xen Security Advisory CVE-2026-62432 / XSA-505 version 2
evtchn: Race between FIFO expand and reset
UPDATES IN VERSION 2 ====================
Typo correction in description.
Public release.
ISSUE DESCRIPTION =================
The EVTCHNOPexpandarray hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOPreset, resulting in dereferencing a NULL pointer.
IMPACT ======
A malicious HVM guest (x86 HVM or PVH, and ARM) can crash Xen leading to a denial of service.
A malicious x86 PV guest can most likely crash Xen leading to a denial of service, but memory corruption or privilege escalation cannot be ruled out.
VULNERABLE SYSTEMS ==================
All Xen versions from 4.5 onwards are vulnerable. Xen versions 4.4 and earlier are not vulnerable.
MITIGATION ==========
There are no mitigations.
RESOLUTION ==========
Applying the attached patch resolves this issue.
Note that patches for released versions are generally prepared to apply to the stable branches, and may not apply cleanly to the most recent release tarball. Downstreams are encouraged to update to the tip of the stable branch before applying these patches.
xsa505.patch xen-unstable - Xen 4.17
$ sha256sum xsa505 80619fdbb547dea191439ef1c9539fa0991e8f6c449b3970a086f3287fb9ce6e xsa505.patch $
DEPLOYMENT DURING EMBARGO =========================
Deployment of the patches and/or mitigations described above (or others which are substantially similar) is permitted during the embargo, even on public-facing systems with untrusted guest users and administrators.
But: Distribution of updated software is prohibited (except to other members of the predisclosure list).
Predisclosure list members who wish to deploy significantly different patches and/or mitigations, please contact the Xen Project Security Team.
(Note: this during-embargo deployment notice is retained in post-embargo publicly released Xen Project advisories, even though it is then no longer applicable. This is to enable the community to have oversight of the Xen Project Security Team's decisionmaking.)
For more information about permissible uses of embargoed information, consult the Xen Project community's agreed Security Policy: http://www.xenproject.org/security-policy.html -----BEGIN PGP SIGNATURE-----
iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmpomrsMHHBncEB4ZW4u b3JnAAoJEIP+FMlX6CvZ5H8IAMKtDfTsBJaoOosFHEU0Gyv96fP98D89URo21RrD V+Lpd9CTatYuTnz53gztlUa7s2/ARYl488bNURwPTdTjSEdJBbFQKrEyAZsryTyh hiIJF7AhQf8LsY3qk2xuJ+/tKc720WK/zsUGVRz6Jhf9W90g5wBhIM1RAhfy7H2t Zn74wXDi4dsMLQg6VivzRq+y+XJfZKR6qoKztiDHk0DBobmJzQFF2cfkiiWDRW9l NuvLxKjsPyS4K+Jcm9k65RzmWfDprxmL/63VDAt0W8dSAe+u1zyDh/aT+OFK5R1g c6CwdjquY4hhSYhwix4TW18LRlY0NA/pqn3FmhLQl3XZmfU= =z4Qy -----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
Xen Security Advisory CVE-2026-62431 / XSA-504 version 2
Viridian STIMER division by zero
UPDATES IN VERSION 2 ====================
Public release.
ISSUE DESCRIPTION =================
The logic to handle periodic Viridian STIMERs performs a division with an unchecked user-controlled divisor value, that can be set to zero to cause a #DE fault.
IMPACT ======
Enabling Viridian STIMERs to unprivileged HVM guests can result in a Denial of Service (DoS) affecting the entire host.
VULNERABLE SYSTEMS ==================
All Xen versions from 4.13 onwards are vulnerable. Xen versions 4.12 and earlier are not vulnerable.
Only HVM guests with Viridian STIMERs enabled can trigger the vulnerability.
MITIGATION ==========
Not enabling Viridian STIMERs for HVM guests will avoid the vulnerability.
Note Viridian extensions are not enabled by default.
RESOLUTION ==========
Applying the attached patch resolves this issue.
Note that patches for released versions are generally prepared to apply to the stable branches, and may not apply cleanly to the most recent release tarball. Downstreams are encouraged to update to the tip of the stable branch before applying these patches.
xsa504.patch xen-unstable - Xen 4.17.x
$ sha256sum xsa504 cc142e53866a27f3c97bd8532f42df2197f9e8e85fb3846b6fcd682d854e5689 xsa504.patch $
DEPLOYMENT DURING EMBARGO =========================
Deployment of the patches above (or others which are substantially similar) is permitted during the embargo, even on public-facing systems with untrusted guest users and administrators.
But: Distribution of updated software is prohibited (except to other members of the predisclosure list).
Predisclosure list members who wish to deploy significantly different patches and/or mitigations, please contact the Xen Project Security Team.
(Note: this during-embargo deployment notice is retained in post-embargo publicly released Xen Project advisories, even though it is then no longer applicable. This is to enable the community to have oversight of the Xen Project Security Team's decisionmaking.)
For more information about permissible uses of embargoed information, consult the Xen Project community's agreed Security Policy: http://www.xenproject.org/security-policy.html -----BEGIN PGP SIGNATURE-----
iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmpomroMHHBncEB4ZW4u b3JnAAoJEIP+FMlX6CvZiF4H+QFl08pzXWh5Zd2uOlbjYCaQMoDFeWSGCAkCcG8z PlKv4yVLPwxUB0W5cPVV61M/fFDgihZh0usNZ/xm5aTt0uhPE31kXItsYRRLPpmg zbV5OgUgIJxeAABML030lNjlAyLBpVculHAWbyFZdMh/xf0bQc1ty8U/xQDLU+IE cohmtH8v6WvK2PxTA8nNj39EB9rUcz1gYInLh2QltW14di7+FUHGISxiIr/eNcUv 9d/at8ESSH1WNeSRSr+sbE0dMRxAQgoMa93GvU7sEvuZtdwOnnET8l1nVN/84kXM sCMq6mjgVDUmSNOH2aBXxewimjp9DV0BLkmliqHrHDKer3s= =intH -----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
Xen Security Advisory CVE-2026-62429 / XSA-502 version 3
vNUMA domain cleanup may race other operations
UPDATES IN VERSION 3 ====================
Public release.
ISSUE DESCRIPTION =================
Accessing the vNUMA configuration data of a guest is still possible when domain destruction has already started. The cleaning up of that configuration information is not synchronized with its retrieval by a device model controlling the guest.
IMPACT ======
While Denial of Service (DoS) affecting the entire host and information leaks and are the prevailing effect, a device model stub domain or a de-privileged device model running in the control domain may also be able to elevate its privileges to that of the host.
VULNERABLE SYSTEMS ==================
All Xen versions from 4.5 onwards are vulnerable. Xen versions 4.4 and earlier are not vulnerable.
Only entities controlling guests (on x86: HVM guests) can leverage the vulnerability. These are device models running in either a stub domain or de-privileged in Dom0.
Only guests which have vNUMA enabled allow their controlling entities to leverage the vulnerability.
MITIGATION ==========
On x86, running only PV or PVH guests will avoid the vulnerability.
Not enabling vNUMA for HVM guests will also avoid the vulnerability.
CREDITS =======
This issue was discovered by Teddy Astie of Vates.
RESOLUTION ==========
Applying the appropriate attached patch resolves this issue.
Note that patches for released versions are generally prepared to apply to the stable branches, and may not apply cleanly to the most recent release tarball. Downstreams are encouraged to update to the tip of the stable branch before applying these patches.
xsa502.patch xen-unstable - Xen 4.22.0 xsa502-4.21.patch Xen 4.21.x - Xen 4.19.x xsa502-4.18.patch Xen 4.18.x - Xen 4.17.x
$ sha256sum xsa502 e6150a6c468906a1bbcd4b9fca1f28cf3dc2c4617d6aab7c48507dbac003df82 xsa502.patch f780c280539aedb3eeb4f5a43f3d2f4bc5a112ca1a2d7ad6a95eb2fbdc5f5cc8 xsa502-4.18.patch a0b2b6f543a566e997a9f38bbd718cc81e8de8e7b442ff47e92260f70e66f647 xsa502-4.21.patch $
DEPLOYMENT DURING EMBARGO =========================
Deployment of the patches described above (or others which are substantially similar) is permitted during the embargo, even on public- facing systems with untrusted guest users and administrators.
HOWEVER, deployment of the mitigation is NOT permitted (except where all the affected systems and VMs are administered and used only by organisations which are members of the Xen Project Security Issues Predisclosure List). Specifically, deployment on public cloud systems is NOT permitted.
This is because no longer exposing vNUMA is a guest visible configuration change, which may lead to re-discovery of the issue.
Deployment of this mitigation is permitted only AFTER the embargo ends.
AND: Distribution of updated software is prohibited (except to other members of the predisclosure list).
Predisclosure list members who wish to deploy significantly different patches and/or mitigations, please contact the Xen Project Security Team.
(Note: this during-embargo deployment notice is retained in post-embargo publicly released Xen Project advisories, even though it is then no longer applicable. This is to enable the community to have oversight of the Xen Project Security Team's decisionmaking.)
For more information about permissible uses of embargoed information, consult the Xen Project community's agreed Security Policy: http://www.xenproject.org/security-policy.html -----BEGIN PGP SIGNATURE-----
iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmpomrQMHHBncEB4ZW4u b3JnAAoJEIP+FMlX6CvZ58sH/2CogHDnmyLVcaB68ySxCnCZI5qNt0VonyH4n3s0 Ef4H74nwh3osLXrvkcnXvbrH4hqDKI3MtydScfHc5dpa1rQHXO8utHxZtGUU+CSv A1nSYD42pu96V5xvTXO+xK5sCZoBREgUNS2TGCE02dkwXdngsCWnAPFn1BQi7wsG LJWuzurlSRSc28PPuIEaKJM+eiyG88ep5fADrLycVPvltqd6bktEE1Xa82h5iSYd 9K7KTEDT9Kc0HZEg4x0h2OBwVqGdKF+8FHDNCEtpiwtE2Ao6OycTVzGNX7f+fq4/ CeQjI8I94j/r1zVPtuGBHNVkUdgrCIe36156RC7f1LFy0JM= =7hf1 -----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
Xen Security Advisory CVE-2026-62435,CVE-2026-62436 / XSA-501 version 4
grant-table: version change racing with other operations
UPDATES IN VERSION 4 ====================
Properly sync backports with staging patch (there was no functional issue, just a code arrangement one).
Public release.
ISSUE DESCRIPTION =================
With the introduction of Grant Table v2 came the requirement to be able to switch between versions. Switching from v1 to v2 reduces the number of valid grant references, as a bigger shared entry structure is then needed while the shared table doesn't change size. Switching from v2 back to v1 the status frames, which are separate in v2, go away.
Code holding, but intermediately dropping and then re-acquiring the grant table lock, sometimes wrongly assumes that said properties wouldn't change across the window in time where the lock is not being held.
The v1 -> v2 issue is CVE-2026-62435.
The v2 -> v1 issue is CVE-2026-62436.
IMPACT ======
An unprivileged guest may be able to elevate its privileges to that of the host. Information leaks and Denial of Service (DoS) are possible as well.
VULNERABLE SYSTEMS ==================
All Xen versions from 4.0 onwards are vulnerable. Xen versions 3.4 and earlier are not vulnerable.
Only x86 guests permitted to use grant table version 2 interfaces can leverage this vulnerability. On Arm, grant table v2 use is explicitly unsupported.
Only multi-vCPU guests can leverage this vulnerability.
Xen versions 4.13 and newer offer a way to build Xen without grant table support. Such hypervisors (CONFIGGRANTTABLE turned off) are not vulnerable.
MITIGATION ==========
Using the "gnttab=max-ver:1" hypervisor command line option will avoid the vulnerability.
Using the "maxgrantversion=1" guest configuration option for guests will also avoid the vulnerability.
CREDITS =======
This issue was discovered by Mark Esler.
RESOLUTION ==========
Applying the appropriate attached patch resolves this issue.
Note that patches for released versions are generally prepared to apply to the stable branches, and may not apply cleanly to the most recent release tarball. Downstreams are encouraged to update to the tip of the stable branch before applying these patches.
xsa501.patch xen-unstable - Xen 4.19.x xsa501-4.18.patch Xen 4.18.x xsa501-4.17.patch Xen 4.17.x
$ sha256sum xsa501 e856d64f5b1a16dbb3d7ec19140f24eca508b62de0d25036fa5735cdd5b72be6 xsa501.patch e006c4fe0a35698318eca59ce828202cac19327f5139d51645116124fc3126e8 xsa501-4.17.patch 10477adfd82fa09123f08497d6a5d44ae61f48d026590ce262cac65f482b2d97 xsa501-4.18.patch $
DEPLOYMENT DURING EMBARGO =========================
Deployment of the patches described above (or others which are substantially similar) is permitted during the embargo, even on public- facing systems with untrusted guest users and administrators.
HOWEVER, deployment of the mitigation is NOT permitted (except where all the affected systems and VMs are administered and used only by organisations which are members of the Xen Project Security Issues Predisclosure List). Specifically, deployment on public cloud systems is NOT permitted.
This is because restricting the available grant table version is a guest visible configuration change, which may lead to re-discovery of the issue.
Deployment of this mitigation is permitted only AFTER the embargo ends.
AND: Distribution of updated software is prohibited (except to other members of the predisclosure list).
Predisclosure list members who wish to deploy significantly different patches and/or mitigations, please contact the Xen Project Security Team.
(Note: this during-embargo deployment notice is retained in post-embargo publicly released Xen Project advisories, even though it is then no longer applicable. This is to enable the community to have oversight of the Xen Project Security Team's decisionmaking.)
For more information about permissible uses of embargoed information, consult the Xen Project community's agreed Security Policy: http://www.xenproject.org/security-policy.html -----BEGIN PGP SIGNATURE-----
iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmpomrIMHHBncEB4ZW4u b3JnAAoJEIP+FMlX6CvZc98H/0wOjr4aa/IMxNH41B8p6vx1ayiBDvTV8qWgmjf9 AyjNGWG5sAjViMDjtFMUE/CeOeoby+gPRfzop9L7cjlHzy8+y/5s9oRUzC+0VIDq 1V5SBbD0XzhqujoLj5LBF0M1a/EyAJzYeVIV3t1DL6yFAz9YRpUGz6pNAwnF0dui bfNZcT2K0+BV0YHUQMrEkAUd+PV/mObG8AiVDS8j9BU8sGN4m1Wx2hsYzqYBCXpK T3lT8dG9qaYcnlH+m9jfWFIE2Srr9a2rLdCMs4dHY1CB/FmZLRrWe304yFuQntET OGiyZWW86cjmANEKAjrYHSD/CRa81gBqdxiAH/N13zBxZ7I= =VVHS -----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
Xen Security Advisory CVE-2026-62428 / XSA-500 version 2
grant-table: type confusion in grant-copy
UPDATES IN VERSION 2 ====================
Public release.
ISSUE DESCRIPTION =================
When grant-copy operations are processed, the respective grant may or may not already be in use by another operation (a mapping or another copy). For all copy operations the referenced guest frame is looked up. When another operation is already active for the grant (the grant is "pinned"), what is being supplied back to actually carry out permission checks and copy operation may not be consistent: The permission check may be carried out on a page different from the one involved in the copy.
IMPACT ======
An unprivileged guest may be able to elevate its privileges to that of the host. Information leaks and Denial of Service (DoS) are possible as well.
VULNERABLE SYSTEMS ==================
All Xen versions from 4.2 onwards are vulnerable. Xen versions 4.1 and earlier are not vulnerable.
Xen versions 4.13 and newer offer a way to build Xen without grant table support. Such hypervisors (CONFIGGRANTTABLE turned off) are not vulnerable.
MITIGATION ==========
There is no known mitigation.
CREDITS =======
This issue was discovered by Roman S.
RESOLUTION ==========
Applying the appropriate attached patch resolves this issue.
Note that patches for released versions are generally prepared to apply to the stable branches, and may not apply cleanly to the most recent release tarball. Downstreams are encouraged to update to the tip of the stable branch before applying these patches.
xsa500.patch xen-unstable - Xen 4.18.x xsa500-4.17.patch Xen 4.17.x
$ sha256sum xsa500 e09e06ef5d4044b4c6104ae83d5e509d45495d7bab1da73f2beb7a916d24f462 xsa500.patch 5fabb02fd4cc62f58a07a8322883b04c638832f65fdf0216a0efde6229d1fd73 xsa500-4.17.patch $
DEPLOYMENT DURING EMBARGO =========================
Deployment of the patches and/or mitigations described above (or others which are substantially similar) is permitted during the embargo, even on public-facing systems with untrusted guest users and administrators.
But: Distribution of updated software is prohibited (except to other members of the predisclosure list).
Predisclosure list members who wish to deploy significantly different patches and/or mitigations, please contact the Xen Project Security Team.
(Note: this during-embargo deployment notice is retained in post-embargo publicly released Xen Project advisories, even though it is then no longer applicable. This is to enable the community to have oversight of the Xen Project Security Team's decisionmaking.)
For more information about permissible uses of embargoed information, consult the Xen Project community's agreed Security Policy: http://www.xenproject.org/security-policy.html -----BEGIN PGP SIGNATURE-----
iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmpomrEMHHBncEB4ZW4u b3JnAAoJEIP+FMlX6CvZ4B4H/1dGUPMt2yREv0C6uHyxT50MoAwaZ01A6Dwm2CNm 2eIjsJGeF3mtlw0T4c6hCmF7fcULFJMcPkJi09TS38ADIOBpivgP+tRkRa+ZRPtG E6vpRtlHmD57WVPWRfTM0uk6UL/CCyvlUILR8A9lu7tF5PFef3Dzeiqpuh/rMNPx DmEcn3Mw8DpKvkoMIVJd1TgAtFX0KwWwByxClUIV84K2SBvcNxVoiw2fkKkx1HRa lB7sVEkKliUyIN/uWmh1VcLshQuulHYNcnkq7ErCEIQqo30ay6WER6W5TS0cfh/F OUSQWlWzkht2GY0pRXp5UQaBFc8UCsOnVty8DhvLrCyllSk= =gRtn -----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
Xen Security Advisory CVE-2026-62426,CVE-2026-62427 / XSA-499 version 2
sysctl and platform-op locks open to abuse
UPDATES IN VERSION 2 ====================
Add further tags to patches.
Public release.
ISSUE DESCRIPTION =================
To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these operations may not be executed in parallel, so a system-wide lock each is used. The way those locks are acquired is, however, not providing any fairness. Furthermore, with XSM/Flask in use, the lock acquire will, for some operations, occur ahead of any permission checking.
The sysctl issue is CVE-2026-62426.
The platform-op issue is CVE-2026-62427.
IMPACT ======
A less privileged entity may stall an equally or more privileged entity, potentially leading to a Denial od Service (DoS) of up to the entire host.
VULNERABLE SYSTEMS ==================
All Xen versions from 4.0 onwards are vulnerable. Earlier versions use a different locking operation, but may also be vulnerable.
MITIGATION ==========
There is no known mitigation.
CREDITS =======
This issue was discovered by Jan Beulich of SUSE.
RESOLUTION ==========
Applying the appropriate set of attached patches resolves this issue.
NOTE: The patches include an adjustment to the default Flask policy. When custom policies are in use, a respective change will need making there.
Note that patches for released versions are generally prepared to apply to the stable branches, and may not apply cleanly to the most recent release tarball. Downstreams are encouraged to update to the tip of the stable branch before applying these patches.
xsa499/xsa499-?.patch xen-unstable - Xen 4.21.x xsa499/xsa499-4.20-?.patch Xen 4.20.x - Xen 4.19.x xsa499/xsa499-4.18-?.patch Xen 4.18.x xsa499/xsa499-4.17-?.patch Xen 4.17.x
$ sha256sum xsa499/ 1b716186d37cb6be7b2917bc4801a5d431111f6a01f6e710e2899b6fbf91d747 xsa499/xsa499-1.patch 7789699993f993aa0f118437b9a18c2207cf29491fa08f21e029aa4293698d38 xsa499/xsa499-2.patch 4860a286a7161a407a7e7dc95ecb04a453847295ca73f91f3bd07c3e9e94b7fe xsa499/xsa499-3.patch fd59436b871caad09017da250996968797ada23223b1e76f9a2e80ae814d63ca xsa499/xsa499-4.17-1.patch 9f83e4866fd20a3e45ecf40a80898446d243444fdf4c17eb695ff7f3d3e9f816 xsa499/xsa499-4.17-2.patch e7e4fcb7502deb605a854ce451403237ea295394dc30f771001680cc3aaa8f9e xsa499/xsa499-4.17-3.patch 3a979d5c59d690313ec9c3d82d8859dadd6d106296cbf6fe75ef9b42f2626bb5 xsa499/xsa499-4.17-4.patch d2b3bcad9eb0d82f16befff35ef8fa0d8ed6d06b7e7e2c360003f1eee14d26b2 xsa499/xsa499-4.17-5.patch ac1f4d1935dc7546c32e5b9c42ebd08d71ca232e559a7021e3ed685c0973675e xsa499/xsa499-4.17-6.patch 143a9b46b3edf689e8b75fb87d1e15b0f0b96baf48547f6d77c00ba5e90ea5ac xsa499/xsa499-4.17-7.patch cd51ddc70ac765ef00a404d3a21c04a0e234ebca1904159820504e10f70e3812 xsa499/xsa499-4.18-1.patch 32f7827da6a6cdff848a1b620dd1a4d4861008f53d31050c6cde1d353794d22f xsa499/xsa499-4.18-2.patch 3ed288dd99051ebb014cf1cd124d5ed0837935bb0d56963f54699a9e3a966c4e xsa499/xsa499-4.18-3.patch 86fecda24801913f408f86db0b02d0017e870fa95e6edfe5d414343c89b29b37 xsa499/xsa499-4.18-4.patch 055c9114e0c1e789ee510dfb739bf8067a7acbdad6b6edaf2c0e7ed3daac2b81 xsa499/xsa499-4.18-5.patch 211b7410562f438e82266d3101beaef32d66c54b4681a370dd3e47abeec7c5c5 xsa499/xsa499-4.18-6.patch a0849d860536a199ebeabb6199012d9eae70ee2ed41573765af50aec7b7e7f85 xsa499/xsa499-4.18-7.patch 48b96df5981193f182eda567ad65f1343718656a36ea1ef2d24bdc534ea4ead1 xsa499/xsa499-4.20-1.patch 3e9a315184f64d41011721b2f09275fcc6969d46be3c6f6b788b65fe78c1a0a8 xsa499/xsa499-4.20-2.patch cf66937eecf0b8a559e60553c21de0e3767270df022c7098d7dd94a46c5ad176 xsa499/xsa499-4.20-3.patch 8932a1480b7431a0ebb048312dda49d5b7d06a5d2b57efb04df0b90bc81e95be xsa499/xsa499-4.20-4.patch 6777a824bc0248f8e12a71f87b60a3209a7a74a08fe7e072d26f80095d188a01 xsa499/xsa499-4.20-5.patch 3ab8c66b133d2b942f7caad0251d427076ad2ef38bcbf6672a937c1406f098ac xsa499/xsa499-4.20-6.patch 1254cc886eb62d65624bcc417701c119e02cc35d31f62e3dda1bda062e170446 xsa499/xsa499-4.20-7.patch 70c315beca0afa411c9e31117d8e0b22b36b5cd70e8d9d2243f5501167a2c631 xsa499/xsa499-4.patch d0ff37c4807445bd5146057ddaed31d7ce5a0fe6abf413a04f4bceca8419baeb xsa499/xsa499-5.patch 961d31a715ae2c8dd25b74243a6c759ce8c43409c4156ae6bbdcf3faac03f592 xsa499/xsa499-6.patch 60cb3b1e4beef97d633a0156feb0f4f10ac8d21c54152969f5b7a77ecc4a24d3 xsa499/xsa499-7.patch $
DEPLOYMENT DURING EMBARGO =========================
Deployment of the patches and/or mitigations described above (or others which are substantially similar) is permitted during the embargo, even on public-facing systems with untrusted guest users and administrators.
But: Distribution of updated software is prohibited (except to other members of the predisclosure list).
Predisclosure list members who wish to deploy significantly different patches and/or mitigations, please contact the Xen Project Security Team.
(Note: this during-embargo deployment notice is retained in post-embargo publicly released Xen Project advisories, even though it is then no longer applicable. This is to enable the community to have oversight of the Xen Project Security Team's decisionmaking.)
For more information about permissible uses of embargoed information, consult the Xen Project community's agreed Security Policy: http://www.xenproject.org/security-policy.html -----BEGIN PGP SIGNATURE-----
iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmpomq8MHHBncEB4ZW4u b3JnAAoJEIP+FMlX6CvZ9AcH/3XOTFbTvmwW48Q6nVkwvys5fiU2esrkFOTK96nn p55QQoVVjebet7N+eRtezkjfHGCqphGOuHcAJ0uMlNNgUfhXNxxu6qaqMHX5h29P DqQKZzOKuQM1frcyupJdhi8dbNxan1pXMv6rJAcWpmBoPEt9e+qwpnWtBX/HPH3b 66cQwLhmenlqwZak7E0bsLFw1A6WUXs1VS4xeiOE3Cj91F5hPUvqkZGI0pNbNAIn 6copsM0UAcTkwGrwIvKuN5b3BqFmaCWvGBfqsuNpj5MnJddigV68UeylMepFjoDH Urn2qiOTcJKxdFt/AUX57AqiBF2MtDbi49RLLxsTCJvYvFM= =R0It -----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
Xen Security Advisory CVE-2026-42494,CVE-2026-42495,CVE-2026-62423,CVE-2026-62424,CVE-2026-62425 / XSA-497 version 2
buffer overruns in libfsimage iso9660 handling
UPDATES IN VERSION 2 ====================
Public release.
ISSUE DESCRIPTION =================
The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them:
The directory loop itself assumes a good record length. This is CVE-2026-42494.
The calculation of the System Use area may underflow. This is CVE-2026-42495.
The Rock Ridge extension loop assumes a good (inner) record length. This is CVE-2026-62423.
The Rock Ridge NM record processing assumes a good entry length. This is CVE-2026-62424.
The Rock Ridge CE record processing assumes a good size and offset. This is CVE-2026-62425.
IMPACT ======
A guest using pygrub can escalate its privilege to that of the domain construction tools (i.e., normally, to control of the host).
If the mechanism introduced by XSA-443 (see the mitigation section below) is in use, then the guest can only escalate to this limited context.
VULNERABLE SYSTEMS ==================
All Xen versions from at least 3.2 onwards are affected. Older versions have not been inspected.
MITIGATION ==========
XSA-443 added a mechanism to run pygrub de-privileged. Using this mode will mitigate the vulnerability.
Ensuring that guests do not use the pygrub bootloader will avoid this vulnerability.
For cases where the PV guest is known to be 64bit, and uses grub2 as a bootloader, pvgrub is a suitable alternative to pygrub.
Running only HVM or PVH guests will avoid the vulnerability.
CREDITS =======
This issue was discovered by Syed Abdul Khaliq of BugQore.
RESOLUTION ==========
Applying the attached patch resolves this issue.
Note that patches for released versions are generally prepared to apply to the stable branches, and may not apply cleanly to the most recent release tarball. Downstreams are encouraged to update to the tip of the stable branch before applying these patches.
xsa497.patch xen-unstable - Xen 4.17.x
$ sha256sum xsa497 65925ac5a322b9eacc8538d6486e3e37ddcb83fe6f02f61c18216ccd2770f964 xsa497.patch $
DEPLOYMENT DURING EMBARGO =========================
Deployment of the patches and/or mitigations described above (or others which are substantially similar) is permitted during the embargo, even on public-facing systems with untrusted guest users and administrators.
But: Distribution of updated software is prohibited (except to other members of the predisclosure list).
Predisclosure list members who wish to deploy significantly different patches and/or mitigations, please contact the Xen Project Security Team.
(Note: this during-embargo deployment notice is retained in post-embargo publicly released Xen Project advisories, even though it is then no longer applicable. This is to enable the community to have oversight of the Xen Project Security Team's decisionmaking.)
For more information about permissible uses of embargoed information, consult the Xen Project community's agreed Security Policy: http://www.xenproject.org/security-policy.html -----BEGIN PGP SIGNATURE-----
iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmpomq0MHHBncEB4ZW4u b3JnAAoJEIP+FMlX6CvZyesH/0dz6MuK3DsILiWvYuGNuX//RcdpBlQtLmyQR382 vpoicCuEAJLJlZFZsPddIxjTxte77nbFs2Ih51br95J//ou6sX7q6V9wDGt4EHDK pF4ECI8SCkHDszogIDGDFiSdi7V7VknGpLCjFtINaAcaRLMHx+MMcdMV80IZyoXw 8p2XY7xvaXyo90I1FiecN7yU0H49sYJswLvihJU55hDuBZ25HLe2K59UGs2uaVm2 J0QKIBi3k20kZ5p9diny+cjU81fVu8LwGPKjvK3KUoyNnFsNbsO5owrAq2w/FSbE 1K54Lj6FXk0w08c4S0kz4zLXKLhSeCl7hFvqUpmQAXaN7ew= =0lw8 -----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
Xen Security Advisory CVE-2026-42492 / XSA-496 version 2
vIRQ event channel binding may break Xenstore
UPDATES IN VERSION 2 ====================
Public release.
ISSUE DESCRIPTION =================
Xenstore, to have an up-to-date picture of the entire system, wants to know of domains appearing and disappearing. To make this more robust, a new XENDOMCTLgetdomainstate was introduced. The management of the bitmap underlying that operation is tied into the binding of the VIRQDOMEXC virtual IRQ. Unfortunately an error path there would tear down the bitmap even in cases when it wasn't set up. Unprivileged domains can trigger that error path.
IMPACT ======
An unprivileged domain can affect the operation of Xenstore, potentially leading to a Denial of Service (DoS) affecting the entire host. A hypervisor crash with similar host wide effect also is possible, albeit unlikely.
VULNERABLE SYSTEMS ==================
Xen 4.21 and onwards are vulnerable. Xen 4.20 and older are not vulnerable.
MITIGATION ==========
There is no known mitigation.
CREDITS =======
This issue was discovered by Grygorii Strashko of EPAM.
RESOLUTION ==========
Applying the attached patch resolves this issue.
Note that patches for released versions are generally prepared to apply to the stable branches, and may not apply cleanly to the most recent release tarball. Downstreams are encouraged to update to the tip of the stable branch before applying these patches.
xsa496.patch xen-unstable - Xen 4.21.x
$ sha256sum xsa496 80a0a807dd9d7ae793b462d78da2bd9d4f84eb5062f3e60622d12edde9c2a27c xsa496.patch $
DEPLOYMENT DURING EMBARGO =========================
Deployment of the patches and/or mitigations described above (or others which are substantially similar) is permitted during the embargo, even on public-facing systems with untrusted guest users and administrators.
But: Distribution of updated software is prohibited (except to other members of the predisclosure list).
Predisclosure list members who wish to deploy significantly different patches and/or mitigations, please contact the Xen Project Security Team.
(Note: this during-embargo deployment notice is retained in post-embargo publicly released Xen Project advisories, even though it is then no longer applicable. This is to enable the community to have oversight of the Xen Project Security Team's decisionmaking.)
For more information about permissible uses of embargoed information, consult the Xen Project community's agreed Security Policy: http://www.xenproject.org/security-policy.html -----BEGIN PGP SIGNATURE-----
iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmpomqwMHHBncEB4ZW4u b3JnAAoJEIP+FMlX6CvZc8IIALEzvp6RymbSYDSTBqNl4k+mRBOfMTdwOGKA9lNm zYl9rFlGcTTR2HogU9Vplm0gQmcrksFndwXMzjkOqLlRnbDs6JsSIpuQaWi6jm7f Fj0QLAMXLxLLMAPvC8j9kLJjJrlv7X1VeYolsHBSq3lCoqb5YgZaqMIDuOXgO9+7 //cSTRbaEnm4UBrV/WxUX1pd6RHOBbioJjyLwy4QZyfoTfXtVrw6bv5IHsq8GyD6 QYRFnh9fZ+33p7LDoU5jUlDO+TnJZeUlbWGqMTsxdGx8l93662nNGDIYrxJr+/8g 6CmXyObBkiI3qXRT7sSt1/FzdnoDIQTPtIyv4xuIi4GMT+0= =V0J6 -----END PGP SIGNATURE-----
Some shadow paging errors paths will switch the page-tables without updating the currently running vCPU reference. This causes a mismatch between the loaded page-tables and the mapcache metadata which can lead to corruption of the mapcache.
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]
To create and manage guests, domctl operations are used by the control domain, a possible Xenstore domain, or by a domain controlling a particular guest. Some of these operations may not be executed in parallel, so a system-wide lock is used. The way that lock is acquired is, however, not providing any fairness. This is CVE-2026-42489.
Furthermore, with XSM/Flask in use, the lock acquire will, for some operations, occur ahead of any permission checking. This is CVE-2026-42490.
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]
To create and manage guests, domctl operations are used by the control domain, a possible Xenstore domain, or by a domain controlling a particular guest. Some of these operations may not be executed in parallel, so a system-wide lock is used. The way that lock is acquired is, however, not providing any fairness. This is CVE-2026-42489.
Furthermore, with XSM/Flask in use, the lock acquire will, for some operations, occur ahead of any permission checking. This is CVE-2026-42490.
HVM guest I/O port accesses are subject to either emulation or at least translation. Translations are managed by the device model (via XENDOMCTLioportmapping), and hence the linked list used may changed at any time. Traversal of those lists (while handling guest I/O port accesses) therefore needs synchronizing with updates, which was missing so far.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
Xen Security Advisory CVE-2026-42488 / XSA-494 version 3
x86: mismatched mapcache metadata
UPDATES IN VERSION 3 ====================
Public release.
ISSUE DESCRIPTION =================
Some shadow paging errors paths will switch the page-tables without updating the currently running vCPU reference. This causes a mismatch between the loaded page-tables and the mapcache metadata which can lead to corruption of the mapcache.
IMPACT ======
Privilege escalation, Denial of Service (DoS) affecting the entire host, and information leaks.
VULNERABLE SYSTEMS ==================
Xen 4.15 and onwards are vulnerable. Any Xen version with the fix for XSA-438 applied is vulnerable.
Only x86 systems are vulnerable. Only 64-bit PV guests can leverage the vulnerability, and only when running in shadow mode. Shadow mode would be in use when migrating guests or as a workaround for XSA-273 (L1TF).
MITIGATION ==========
Running only HVM or PVH guests will avoid the vulnerability.
Running PV guests in the PV shim will also avoid the vulnerability.
CREDITS =======
This issue was discovered by Roger Pau Monné of XenServer.
RESOLUTION ==========
Applying the attached patch resolves this issue.
Note that patches for released versions are generally prepared to apply to the stable branches, and may not apply cleanly to the most recent release tarball. Downstreams are encouraged to update to the tip of the stable branch before applying these patches.
xsa494.patch xen-unstable xsa494-4.21.patch Xen 4.21.x xsa494-4.20.patch Xen 4.20.x - Xen 4.19.x xsa494-4.18.patch Xen 4.18.x xsa494-4.17.patch Xen 4.17.x
$ sha256sum xsa494 6e3328f73000afdfffa5e4d9fec89a4c9456d97758bfa1a0605765a386565328 xsa494.patch 483675d6cb69b70e919110f58814b047787c3b53def344cf32f4acdd7ee9b271 xsa494-4.17.patch e637dce8cd5ecf7c30501ab2eb0af5240ff0a36844b257ca7dd14094d5118aa2 xsa494-4.18.patch a70aa60fb5dcf171025c5d90e332dcae95a83bbf9d42ab45451f629621f455e5 xsa494-4.20.patch 14f9698060c523893f710cc5ab3ec723c75a99e5caa193b9281d4a06016bf687 xsa494-4.21.patch $
DEPLOYMENT DURING EMBARGO =========================
Deployment of the patches and/or mitigations described above (or others which are substantially similar) is permitted during the embargo, even on public-facing systems with untrusted guest users and administrators.
But: Distribution of updated software is prohibited (except to other members of the predisclosure list).
Predisclosure list members who wish to deploy significantly different patches and/or mitigations, please contact the Xen Project Security Team.
(Note: this during-embargo deployment notice is retained in post-embargo publicly released Xen Project advisories, even though it is then no longer applicable. This is to enable the community to have oversight of the Xen Project Security Team's decisionmaking.)
For more information about permissible uses of embargoed information, consult the Xen Project community's agreed Security Policy: http://www.xenproject.org/security-policy.html -----BEGIN PGP SIGNATURE-----
iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmon+5MMHHBncEB4ZW4u b3JnAAoJEIP+FMlX6CvZ+HcIAIpJbk3ISxjsn0ZFBXR01iOGubj+Y/vKE4mdJe1y 1//aeWPL26enDoyZ5KoT+hiC2qogTfT1p71MIS0Gns44UfVOw95xlrd0eUO//5td NQk7YFYn/WB+z9KWcdV8+Lo3zKiMNFiILCeK2+WefByfBQfZ/WFBQ48WZpxnkxHo j7cgtmtmTStmIDEWxY0pfdEWHPCBGX3SvUGWKR2tl5tZZxjd+yIij4fjLzUCKxU3 r4dYblTAg0JyDsI2SR16TLRSKyWxnwprzlb2fJEDsZXoZvIetf6jhHpvfFY+Z2m1 zlLfFDam+oGQI1CwrMNCz69AaeJzyTnRdiY+BM51lpgdjj0= =pLmw -----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
Xen Security Advisory CVE-2025-10263 / XSA-493 version 2
Arm: Completion of memory accesses not guaranteed by completion of a TLBI
UPDATES IN VERSION 2 ====================
Public release.
ISSUE DESCRIPTION =================
A hardware issue has been identified in certain Arm CPU designs. A broadcast TLBI on one PE may complete before affected memory accesses on another PE are globally observed. This may permit bypass of Stage 1 translation, Stage 2 translation, or GPT protection.
The erratum occurs when all of the following conditions are met:
- A PE (PEx) executes a store. - Another PE (PEy) executes a TLBI instruction which applies to Stage 1 only information, Stage 1 and 2 information, or GPT information (but not Stage 2 only information), applies to the Inner Shareable or Outer Shareable domain containing PEx, and affects at least one of the bytes accessed by PEx's store. - PEy executes a DSB instruction which is sufficient to complete the TLBI instruction. - Complex micro-architectural conditions occur.
When all conditions are met, PEy's DSB may complete before the global observation of a portion of PEx's store which was affected by the TLB invalidation. This store may complete at a later time, after memory accesses which are ordered after the DSB.
The relevant TLB entries are invalidated correctly before the completion of the DSB. This erratum does not affect reads.
For more details, please refer to the Arm Security Center: https://developer.arm.com/Arm%20Security%20Center
IMPACT ======
A malicious guest may be able to write to memory it no longer has permission to write to, after Xen has modified Stage 2 translation to forbid writes to that location. This could allow a guest to escalate its privileges to that of the hypervisor.
VULNERABLE SYSTEMS ==================
Only systems running Xen on Arm are affected. x86 systems are not vulnerable.
Only multi-core configurations are affected.
The following Arm CPUs are affected:
- Arm C1-Ultra, C1-Premium - Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse N2, Neoverse N1 - Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76AE
MITIGATION ==========
There is no known mitigation.
CREDITS =======
This issue was reported by Arm.
RESOLUTION ==========
Applying the appropriate set of attached patches resolves this issue.
Note that patches for released versions are generally prepared to apply to the stable branches, and may not apply cleanly to the most recent release tarball. Downstreams are encouraged to update to the tip of the stable branch before applying these patches.
xsa493/xsa493-??.patch xen-unstable xsa493/xsa493-4.21-??.patch Xen 4.21.x xsa493/xsa493-4.20-??.patch Xen 4.20.x xsa493/xsa493-4.19-??.patch Xen 4.19.x xsa493/xsa493-4.18-??.patch Xen 4.18.x xsa493/xsa493-4.17-??.patch Xen 4.17.x
$ sha256sum xsa493/ b065245ad3e22d19a0a1f26af6978ebf52f1d59f4ddeb4aeb03eb198bc12f2fd xsa493/xsa493-01.patch d8f3896d4916867aaefe340ce4d2bce0c3698c093e59ee863677d6524f43a000 xsa493/xsa493-02.patch d77017101f424f792b560b37c82d75108b68ff9183a640fa680ba6f5fc9928aa xsa493/xsa493-03.patch a1cd4eabe923d1d4197c95a9ce8f233a226a49cd4bf6c8651b7a11f89fccc0ed xsa493/xsa493-4.17-01.patch 7238d3bbfe6bfd96fac0da8fb36456c23519938fe694a9f90a9f7317ba1c8fdb xsa493/xsa493-4.17-02.patch b561f4c7365fd6f39a35661bcc74330126abdf7f022e6340b56c6beaf5dad9c2 xsa493/xsa493-4.17-03.patch 84f818e5549cc48ca93cc7f153162881c825c51cc1da1d7e677ca1779db4e2a7 xsa493/xsa493-4.17-04.patch 1226029b0bdb4091979819bcbbe4480cb4dc4c8073758dcfa4c418dec5ff49e5 xsa493/xsa493-4.17-05.patch 59f49949a1cb27580e846cbc08402f496228de129607a90c84603c9961d7c51e xsa493/xsa493-4.17-06.patch f6175dc3287d38ec7c225dee428e17d6dd66c2457668942fadbf5aff78cffa1b xsa493/xsa493-4.17-07.patch da413bb5e5e3114e7cbbfa8ee26ffed61f902475d2ef809893a2b4002d41dd01 xsa493/xsa493-4.17-08.patch 3ef94e7a74c4e5c06655174245d004819ce6dfdc1d54f63c2463e5edf8ea182b xsa493/xsa493-4.17-09.patch 5d604ef4efffe2a199dbe8e4dcb46883e1ec294b71f7d2679bcbfa4a3d6ae168 xsa493/xsa493-4.18-01.patch 074fad2b5bf195337c0799d59493a621e1020d8cb9834ed2997997b208d498d3 xsa493/xsa493-4.18-02.patch df6dcfc54ddfee83e2bfc00448d7a3dedda9c8c0858ea3258ebdaf674d9cf8a4 xsa493/xsa493-4.18-03.patch cc3457e14c2b35afef35a9fd3cc3905f6e03b0f30333b56b963bc1577dbcf4a8 xsa493/xsa493-4.18-04.patch 4b523acb3b5904d649531f8c78e701ec9384e02045fc941d2ae061f28d9c5e73 xsa493/xsa493-4.18-05.patch 3511018842968d19e34e949800d638d648ddfaad7511f80f53acfb96af244750 xsa493/xsa493-4.19-01.patch 5e157dd88c71d10323f3102f555a069c1ded6ecb203a69d53c7e441ecaaa06fc xsa493/xsa493-4.19-02.patch 5da2ee837cb3bd151af442397c32bd5afca508b4d2f237fd6a395f20d41b740a xsa493/xsa493-4.19-03.patch 797955e752e4010b2df5dadf75bf210a00a8ad1bfe6ee8848b5b68734ec3cd2b xsa493/xsa493-4.19-04.patch dfa9616895e9768b6f0d7c6efc903b00e2e51af4e0f5c38a29e79d17ea272b86 xsa493/xsa493-4.19-05.patch 0e50dae0a0dddeb2755f761f966a8d0a9186246504dacda4dd5994367f71ea8e xsa493/xsa493-4.20-01.patch 9d9911d02f5ca5aaaf9fe3700e0ff66371d1bb469471e4bf6c305a786329f3d1 xsa493/xsa493-4.20-02.patch 9058d6dfe2fcbedbb0b10d529e9e3d3e7635381d12b41383832e163aff156002 xsa493/xsa493-4.20-03.patch eb81f949744f3e748a871dc81eb0774e58faeb3bcc6c486f2237b9f516fdad00 xsa493/xsa493-4.20-04.patch d4eb81c40cedbdd425429c340da45d7bb344b63d71328d8cc978fc70f606804d xsa493/xsa493-4.20-05.patch bd2e39066c4f9a9ed20a9214d6dd4cb71a5fa34349129398dba03b684ab49478 xsa493/xsa493-4.21-01.patch b4b603075259fa6274b61a09133d59c8846910a29dd5b0d5af2d55a0adc67659 xsa493/xsa493-4.21-02.patch 721d339f1c18f6867d5a5a0d02e3edceb8d97ed08725787b3537969a656d74f6 xsa493/xsa493-4.21-03.patch bfc9c9b005968f33f8a33116be7f8ce9918cd3020f35f8bd173727ac19bb0261 xsa493/xsa493-4.21-04.patch 738177c22c9b081165fb4500c05ddf53b7e9e1de68b3190462eb8cb66a5aa6a5 xsa493/xsa493-4.21-05.patch 0d6bca07e5177f4e13c572410224c5cea0c10b5004c370dd742c7c725d98a9be xsa493/xsa493-04.patch $
DEPLOYMENT DURING EMBARGO =========================
Deployment of the patches and/or mitigations described above (or others which are substantially similar) is permitted during the embargo, even on public-facing systems with untrusted guest users and administrators.
But: Distribution of updated software is prohibited (except to other members of the predisclosure list).
Predisclosure list members who wish to deploy significantly different patches and/or mitigations, please contact the Xen Project Security Team.
(Note: this during-embargo deployment notice is retained in post-embargo publicly released Xen Project advisories, even though it is then no longer applicable. This is to enable the community to have oversight of the Xen Project Security Team's decisionmaking.)
For more information about permissible uses of embargoed information, consult the Xen Project community's agreed Security Policy: http://www.xenproject.org/security-policy.html -----BEGIN PGP SIGNATURE-----
iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmon+5EMHHBncEB4ZW4u b3JnAAoJEIP+FMlX6CvZl9sH/2gOt3FnPag044GT7tB/PZHNzVPNZKsqKv6TbKrh Sd+3da3eoNX9Py4AJ25t/jUkuLoZLL1yc7Mo/6nXj3/YevWb0RgUIc8Z0nUSi17f yBcbtAaOYlGmmDGlC/MY9H4xT2htYJXwA+XOztb7k7VS0j9g8xEv8q08RBM1Jibd nelqwwKiDm7kJS7AtuA8bHWX+pNuvGKqKvt+AhHD6F6XXsFzZ7fU1F2Sin/Rxj2V fi8EDJcaCBNWuyajpvQbpt3vZJX5cV4n6HnkSeUxEOyLbkSMk3oH3EIqPRbuV8V3 g2WFu5NEbyjwIUOHENQubIH1isSQ8ogx6e/JPR/fgLPJtU8= =wDng -----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
Xen Security Advisory CVE-2026-42489,CVE-2026-42490 / XSA-492 version 3
domctl lock open to abuse
UPDATES IN VERSION 3 ====================
Public release.
ISSUE DESCRIPTION =================
To create and manage guests, domctl operations are used by the control domain, a possible Xenstore domain, or by a domain controlling a particular guest. Some of these operations may not be executed in parallel, so a system-wide lock is used. The way that lock is acquired is, however, not providing any fairness. This is CVE-2026-42489.
Furthermore, with XSM/Flask in use, the lock acquire will, for some operations, occur ahead of any permission checking. This is CVE-2026-42490.
IMPACT ======
A less privileged entity may stall an equally or more privileged entity, potentially leading to a Denial od Service (DoS) of up to the entire host.
VULNERABLE SYSTEMS ==================
All Xen versions from 3.3 onwards are vulnerable. Earlier versions use a different locking operation, but may also be vulnerable.
MITIGATION ==========
There is no known mitigation.
CREDITS =======
This issue was discovered by Andrew Cooper of Citrix.
RESOLUTION ==========
Applying the appropriate set of attached patches resolves this issue.
NOTE: The staging and 4.21 patches include an adjustment to the default Flask policy. When custom policies are in use, a respective change will need making there.
Note that patches for released versions are generally prepared to apply to the stable branches, and may not apply cleanly to the most recent release tarball. Downstreams are encouraged to update to the tip of the stable branch before applying these patches.
xsa492/xsa492-??.patch xen-unstable xsa492/xsa492-4.21-.patch Xen 4.21.x xsa492/xsa492-4.20-.patch Xen 4.20.x xsa492/xsa492-4.19-.patch Xen 4.19.x xsa492/xsa492-4.18-.patch Xen 4.18.x xsa492/xsa492-4.17-.patch Xen 4.17.x
$ sha256sum xsa492/ 63352768b73f07b930185c5e02a57d6cf01f803020baf91c0868d4d13c328ada xsa492/xsa492-01.patch c4621381aa70785f78cba48c2a83a61a397941d907ff96978f6a0ee53e272c6d xsa492/xsa492-02.patch fb2413fc6d250cc3bbebee3d6d9c2c13d8cb22670e02d92ffdf4e6d4c4cd1781 xsa492/xsa492-03.patch 1d8e4fb30145ec084d6847624d3445074cb3d2d11983555e20e83f47fa6b082b xsa492/xsa492-4.17-00.patch 3ebd555a3a95ac2f3569566ae8635258029512ea1209ab1cc87a0acbbab0371d xsa492/xsa492-4.17-01.patch 0f2fc5f48cadcf8ebcb47363e4a355b209ce43e9d29f296fea62e7e49961b6cc xsa492/xsa492-4.17-02.patch 9f33b50c4ae0836e40891d2dcf106e9bee178394557563747130eb60c8d80d98 xsa492/xsa492-4.17-03.patch 57b988d15a5c76b0e7b828c64150a9ac7ebc3fd82cced5b19f5e7986e498790f xsa492/xsa492-4.17-04.patch f8e0eedaacb535158fadd5b8695f78db630075c417ffff60e50cdc9bd4ef9809 xsa492/xsa492-4.17-05.patch dd9a6f79ba21ec3840f8591656819117e8b6cb5c43cd8d556b3bfc43eff0e866 xsa492/xsa492-4.17-06.patch 057c2b1e57fb1134054c9f31bc6a21387d3f56880bdc270f12a277028d3d3f0e xsa492/xsa492-4.17-07.patch bea7d3da84529768a55022196dc72e56fec49f48c933acc0c130dc530e479fed xsa492/xsa492-4.17-08.patch 32c322e2d9c9c2d7159e8aea4f8e4c66f9512046baf49127554b8485f0a6b233 xsa492/xsa492-4.17-09.patch 0a5d858d2c07990e3f0f86f1433199f06a5cbbf71013e67e92ea42d29d855f08 xsa492/xsa492-4.17-10.patch f06d1cc9fa48c1411bbee4bd27583268b4bc6e6dfffbb816d16b238759b819c9 xsa492/xsa492-4.17-11.patch 0a1f15cade87920b68d6725444525845eebfd87847ac3bd79edfe8034ee7d69a xsa492/xsa492-4.17-12.patch 3a11ab04730d06bf513ac1cc138ced306972dcfb574dcedd96c0af3e1825e792 xsa492/xsa492-4.17-13.patch 2b4b541a620a0e0d6b14b664d414c33807fbbff0328878332025b331bf367152 xsa492/xsa492-4.17-14.patch 362f412392e6deff71aa27a849f84f457b231d78c0b0ce5ff8125acad6d81166 xsa492/xsa492-4.17-15.patch 9d38b126c62e7d6e37b88a3f8879e3f96c3cdc0a8b087a1541d3eb2779dddc28 xsa492/xsa492-4.17-16.patch cc88c36af3ad28c5f782c05afc2972cfa5f2d10933c2f10bb8651b35fb3fb5b9 xsa492/xsa492-4.17-17.patch 28fd452acfea8b6f47fe5315a4e9125e06f073107f4da81b8cf9cfd405c1fb81 xsa492/xsa492-4.18-00.patch 965778b12e11e65963f3ae1641699384fec3274e09038ee945f137ecb214fda9 xsa492/xsa492-4.18-01.patch e4dec4550afb6e010f12ffa782b168d428976697206985ed9b478dba1ce6d087 xsa492/xsa492-4.18-02.patch d1b84fd8b60bd3e68a403f890a99975b4600447f018a2454ec96e6d36c8133bf xsa492/xsa492-4.18-03.patch 399a32394bafe04834d0927dfebb25b676e8186303414cc2d00aaf7496ceb7eb xsa492/xsa492-4.18-04.patch 971d8802dce02250dfe0b97488ac7471c9ec40ad59e712c86628e6ed085052de xsa492/xsa492-4.18-05.patch 69fb9b404942a001102ffa473c821fe6f2ec834ec61c0c096a5e099988a5184c xsa492/xsa492-4.18-06.patch eef5610ac16c88764a24af7d7a88766b7cb35fd7aa2211d5251418e1e24cd73a xsa492/xsa492-4.18-07.patch 81a98a4ad7bfe80d5ab9570fc24618b6b0d8ad1bbea0c7b64e111db12c3d880d xsa492/xsa492-4.18-08.patch ac8666d08a690dbf6a418befc259d3c9120a7bab4b5aee454d96745e81d1b7e4 xsa492/xsa492-4.18-09.patch 0f5dcc2c22f0635b9dc2a271dcb0d3d518c29e32847dcd53523ed833b28cb388 xsa492/xsa492-4.18-10.patch 20e49ae722a10f834029aaed14cc130e155396e23505dc5b7ea8bf534538225d xsa492/xsa492-4.18-11.patch e6992e7dd686ed6c973754889a5f751e3c330268f373041a50145387c7cd0017 xsa492/xsa492-4.18-12.patch c06ad87cd7262f20e560320b35cd90f5354d244aed7912d01e03914b4e8dc429 xsa492/xsa492-4.18-13.patch dbf79d33d0c8f0d3d846f450e8ebac7c191996d824ef391ff9f8413a6d733060 xsa492/xsa492-4.18-14.patch d7c23e1acbff4154fbabf4ce6bede0ad212a9a1673f1f3f57dc313a694497b79 xsa492/xsa492-4.18-15.patch c5347ddf16789ab7d6b96e89e55116f248b56ee5bcac2fd5398563cffc6b7d06 xsa492/xsa492-4.18-16.patch 952b09b60cdb2c8a27ead0e77744add60d48e053ad0515019928d1a4d839e12e xsa492/xsa492-4.18-17.patch b8fecc7c43b3c6e6df00f77be89127fdd628f6ee0f819b622af4ce92b99c7948 xsa492/xsa492-4.18-18.patch 44b826e2c6fbac8e90b383c1e556ef92272c14186aaf8b83feb417eacd9d1d5d xsa492/xsa492-4.19-00.patch 965778b12e11e65963f3ae1641699384fec3274e09038ee945f137ecb214fda9 xsa492/xsa492-4.19-01.patch e091273f87c80fdf3671accfa3e74bf55f1931f0a4828cd81bf6bcb835d85e1a xsa492/xsa492-4.19-02.patch e91084d7d61a737e9d5625aa6c4582fbf4ba7bd0b5dcc963fa88cf530cdaeb46 xsa492/xsa492-4.19-03.patch c778eaa47fcedff1db398f1301ed05e41e1dbd4be0ea5ed95f46ed30dbcdcebd xsa492/xsa492-4.19-04.patch d645785ea47cdcf82c1aabe31c2a3f0cb3f3977152abc7226a72ac00861f3981 xsa492/xsa492-4.19-05.patch f73f4316859ee6579cc76cc9a1b83976151ffaa6504cc0e31c5f8240a08de1b7 xsa492/xsa492-4.19-06.patch 778c9862ff28a9c0c717c749f598fce59ae997287a2784d990a83cadfc1d33aa xsa492/xsa492-4.19-07.patch bf115087899d1245a28438a032701b5cd7c6c23b54e2b8c371fd63a0f03fab33 xsa492/xsa492-4.19-08.patch 24d59c55d5cc50b02fcbeb6b6c6803460d5cd9c5c570f758d2350431d2eaf84e xsa492/xsa492-4.19-09.patch 274520906d1d700bbb8fcf6b20ae2241b7ac348e629e9ddb74ee1954a70a8421 xsa492/xsa492-4.19-10.patch fce37cbb80e2c117c181517bf8970cc017e34ab6fe76177d4248b0de11ed5def xsa492/xsa492-4.19-11.patch 3f4ce0153c1f72afc7aef1249bf3eda984fba0a33bfb743b044ea00a6a8a649b xsa492/xsa492-4.19-12.patch 851a1002916655dc6080d9dfafe0ec3ead6b0036a75417abe578bfd0feb62d81 xsa492/xsa492-4.19-13.patch e3942ee271b1eaad57a994fe1fae66cc419bd6e1906d63f76316080d06ebb3c4 xsa492/xsa492-4.19-14.patch e4ac87f343a4a07f13f71128612a2c2291c3488a91e3a4f9450e1ba3f6ad5387 xsa492/xsa492-4.19-15.patch 3fc255759588c8c5c38b23231f4cacffd1b74150489c8469c9a2fd033960de97 xsa492/xsa492-4.19-16.patch de1b799184e192c42c6880fd881c0c2b5d875cc59e1d7311b503b91607598493 xsa492/xsa492-4.19-17.patch 545f7bb417976dbabe347d035a363874b8402877168ab789f3629008d009d45b xsa492/xsa492-4.19-18.patch 9a092bba381acc3061dbbaa73a237aa6eec3e9313d3ce0da61e18bfb88a021ab xsa492/xsa492-4.20-01.patch cd0da8fff3874e6ef120cd2511d9c6820f9fe55c26e6df2dbd1472c0001a9a18 xsa492/xsa492-4.20-02.patch 47e0903d30b4d8c1b557fb924cbd8af4ed29bc799972a539f38a04f89bcead60 xsa492/xsa492-4.20-03.patch c878e0d086032948de3c21b15258ed3fb94f935e02859030e19d3238ed5c38bf xsa492/xsa492-4.20-04.patch 765ed1d22e8c3c16f85b66846ea4b61bab5214445c72785acff67441331ab797 xsa492/xsa492-4.20-05.patch 2a16e862743f2e0a276bafb37847b5dfd97249ff93daa92d75bf839905a0030c xsa492/xsa492-4.20-06.patch 8053a4fad16268ccaddbffcc52fffabae8a47e6ff4f1f83140c3ee7bccf97305 xsa492/xsa492-4.20-07.patch 223298c5fcd68cac15d87026141a6adfbc07f5f05a1577e58b7569a6467ab6ed xsa492/xsa492-4.20-08.patch 649f634aca4943886cf9ab02650993eb0e4ca7d2e1648239813ea68f4a0df015 xsa492/xsa492-4.20-09.patch 7666dce350ee5e4eb4d284c851a074423252282dcf2e0d5621a0277da00c05bb xsa492/xsa492-4.20-10.patch 57f7d845972af8c595869857b16658345ca03956e0a82d6c9e87542f02b5fe98 xsa492/xsa492-4.20-11.patch 55a8356f6a8dd2f0ca1904c21f25bd77abcebedf37b33710b7cacdec4f34f230 xsa492/xsa492-4.20-12.patch 9e75bcd02512b28133b0c608c67e17bef038df7d4fdd6f91813c42d5da294fc2 xsa492/xsa492-4.20-13.patch 34f19a0c48fb23ed0669334530f8c4206bec76f53f584c3d7a99bde19503edfd xsa492/xsa492-4.20-14.patch 640fe725ddc35c6f3b70468a1f4d5b16f17b9c9817e70bd48b1628efdd75a4a1 xsa492/xsa492-4.20-15.patch d56f9d42acc925377b81768005d524801d1841b3afe0351e23f99ee06a40a01f xsa492/xsa492-4.20-16.patch 65165d7a6337d416eb193c50b3cfcb9d0ae85e7e1bdfcfa2b87449547e607c85 xsa492/xsa492-4.20-17.patch f04d3a090e30d5333191975e1486fe905fa0d26dcb98b84bd05ec37a9fc0875a xsa492/xsa492-4.20-18.patch 8b5c37b6eb1fc7f6b996dfd27c273e54b552a3a47c5b886bf05f512741491ede xsa492/xsa492-4.21-01.patch 7d0991610408600cb61b045fa09dea0e378a0ff7fd69dde3fc12dfdf857f7175 xsa492/xsa492-4.21-02.patch a0e60503408cbf7ffcdfe10ea9989631e924bb98040629ef1e544b4b771a8109 xsa492/xsa492-4.21-03.patch 2c8dd916a2b23dffc96bf3894a9b1213af87ca969549cb1f4d43b20b3a4fcef0 xsa492/xsa492-4.21-04.patch b97054289876287980ebbf07fcc2f8b2d493388f70c397aa047856664475199d xsa492/xsa492-4.21-05.patch 31677c9abcb3ede946a55401fc5bf5a965aff0b151b20144946400dd33d9de16 xsa492/xsa492-4.21-06.patch 04c9ec91ffa0b719b78dd95325433b7a9b2a36f712aaa11d4d86568454d62bb0 xsa492/xsa492-4.21-07.patch 89d80c6d0ac31aa55964d6d6f5aa9cd73c7887f8c51caf047d5312cbba64cbf1 xsa492/xsa492-4.21-08.patch 9ad936500fed5a4346b59d13ae0dc158a3199921eb4f24b0dc769fba046dcee3 xsa492/xsa492-4.21-09.patch 566de44fd6cc63f8252eb4cb617881497706f46578cea5bec24c94059f9b2ec5 xsa492/xsa492-4.21-10.patch 348ae9e83eaf8f4f5d7af19a37d24b8ab98849aa0d0afd60d20139d3c3de287f xsa492/xsa492-4.21-11.patch 46ffaaab2aa919edc29c6ec3eae47573879481a5f1dc86887177b5669469c0b7 xsa492/xsa492-4.21-12.patch 7b183f27d264b9dd3a1f0daf758b6563493fb91dc434ee443754972fdeeccfc6 xsa492/xsa492-4.21-13.patch 6ad6e6d3c74ab675f156efea374cddf2ec6253d541840517db466fd81ad07407 xsa492/xsa492-4.21-14.patch 5af5ba298c1119a569c17f4cc30ff6b000663bae0e88daa77fc760517039c296 xsa492/xsa492-4.21-15.patch 78f4273344aae2f16c725a4914bc3f6c3e24a6daf4b2989dc6fef8a415721a90 xsa492/xsa492-4.21-16.patch d178ebc53aa010692f77f45f39eaaf80ac3c2f4289a22727e355c530473cc5f5 xsa492/xsa492-4.21-17.patch 7724f047e4466ed46a53acc0b2a7bbbef5cf187bb459385810be40b55222c921 xsa492/xsa492-4.21-18.patch 79f24e539e1fbe1becb12abc0acf5ae2bfc8eb050fbaf45a5e8dfc9bfad66e45 xsa492/xsa492-4.21-19.patch 295260a51fdf5605f7a55c5f78639baeb17b820e28d6c03a93e7d8da3ccd16a9 xsa492/xsa492-4.21-20.patch 85fa36453fc4dcabc468fa870dd81efe6945ec5eca5da84eda8b3317527255aa xsa492/xsa492-04.patch c6d225644365a7d6cd284fa52b8240333baf51ff7bf6ff9264b0496fb6c60eab xsa492/xsa492-05.patch a6e99b4d9c6db7305a1ab426aabf16d296e01b1f1e966c9773e4c7e2a8d045d1 xsa492/xsa492-06.patch e1be3cd0c991d3626f3cbdaf8a70aab756b2c7c0cec734f7f6f5f3fc776167a0 xsa492/xsa492-07.patch 5308abfd84083cb6ffbcc8f8eb3ff4452da09666adf7740af203c764770c9ff1 xsa492/xsa492-08.patch d150da12954c776b47bf813f553eb784ce792c674464474ff24fff172b1249e1 xsa492/xsa492-09.patch db67d1342177697dd83de757b8c29477ccb71fb91239b0362f23c722e2e744f8 xsa492/xsa492-10.patch ed8140d31c764763cbb1fec06653d066fcdcd3a2862edb1a60e51096ba731d46 xsa492/xsa492-11.patch 0323bdf50a97f30f9a98b145575c466d9af8eddedb8a2e8c3d7a643b46cab3c1 xsa492/xsa492-12.patch 61605cec3fcbf980e89b458c48742dd9e911b6dc217ed47f3806c0f049b39129 xsa492/xsa492-13.patch 533e227aefdb4d2dd06c0ffe6c3caa1e865dd12a7919b0e5a55f0863a290d1d3 xsa492/xsa492-14.patch 5f47dee12852e252116d2e4cbf5c7a18f412316e00346ec3845185e2c77eb438 xsa492/xsa492-15.patch 1300425e6a4f7f759cb08d02f5fb20002e9af275985144e987b5357b6cc3189e xsa492/xsa492-16.patch 89075c922eca804d6eda4dc5a7200a750ce16718a791e58813c2a869e09bfe90 xsa492/xsa492-17.patch 552d430465b89dbd15165cf3a03fa95a9d2d9cacd29cd3fc5c44c511596d39cf xsa492/xsa492-18.patch e7fe60cfb996eec460e9de2acce7a32b0b3fb3557cd35945faec67b4909c663d xsa492/xsa492-19.patch 15edac4769d98a09085bef4845f9485017611ffb9b0a9c65ac32cae557531ccc xsa492/xsa492-20.patch $
DEPLOYMENT DURING EMBARGO =========================
Deployment of the patches and/or mitigations described above (or others which are substantially similar) is permitted during the embargo, even on public-facing systems with untrusted guest users and administrators.
But: Distribution of updated software is prohibited (except to other members of the predisclosure list).
Predisclosure list members who wish to deploy significantly different patches and/or mitigations, please contact the Xen Project Security Team.
(Note: this during-embargo deployment notice is retained in post-embargo publicly released Xen Project advisories, even though it is then no longer applicable. This is to enable the community to have oversight of the Xen Project Security Team's decisionmaking.)
For more information about permissible uses of embargoed information, consult the Xen Project community's agreed Security Policy: http://www.xenproject.org/security-policy.html -----BEGIN PGP SIGNATURE-----
iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmon+5AMHHBncEB4ZW4u b3JnAAoJEIP+FMlX6CvZ2VEIAJ77x56m0qwMOSA7YRUFeFEAS4u0C597ooGMskZW mLcehR/NpnGetfiY6/XbEUiCXzJiHsSeG4OWygw8LRpRztPKR8VpA+seJx1My3iX vBsFmzVA4tXRKSorV4/kZx5uIUNXtCMFY9Zm0BQGlrmBoel7/6/Mk91sS+dYJtc9 SZM8MDSGlPAvENe35+IzmCnTGIZhtgIaaoIYjbRRO/oV0Zfz/S1yXGyD6yzwSkbV qNfgOV3KDQn0AmJRZsHBuw3SMFG+lFQhLAWpqTfu8d8pIc5wGqtTs02uJrC7gY+O WRl+hfzIPhG2cH6SNsaYq/t3OSSWeYQAwf7gm4Fg/OZ32ac= =Sg49 -----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
Xen Security Advisory CVE-2026-42487 / XSA-491 version 2
x86 HVM I/O port list traversal
UPDATES IN VERSION 2 ====================
Public release.
ISSUE DESCRIPTION =================
HVM guest I/O port accesses are subject to either emulation or at least translation. Translations are managed by the device model (via XENDOMCTLioportmapping), and hence the linked list used may changed at any time. Traversal of those lists (while handling guest I/O port accesses) therefore needs synchronizing with updates, which was missing so far.
IMPACT ======
A device model of a HVM guest can cause a hypervisor crash, causing a Denial of Service (DoS) of the entire host. Privilege escalation and information leaks cannot be ruled out.
VULNERABLE SYSTEMS ==================
All Xen versions from at least 3.2 onwards are vulnerable. Earlier versions have not been inspected.
Only x86 systems are vulnerable. Arm systems are not vulnerable.
Only entities controlling HVM guests can leverage the vulnerability. These are device models running in either a stub domain or de-privileged in Dom0.
MITIGATION ==========
Running only PV or PVH guests will avoid the vulnerability.
(Switching from a device model stub domain or a de-privileged device model to a fully privileged Dom0 device model does NOT mitigate this vulnerability. Rather, it simply recategorises the vulnerability to hostile management code, regarding it "as designed"; thus it merely reclassifies these issues as "not a bug". The security of a Xen system using stub domains is still better than with a qemu-dm running as a Dom0 process. Users and vendors of stub qemu dm systems should not change their configuration to use a Dom0 qemu process.)
CREDITS =======
This issue was discovered by Jan Beulich of SUSE.
RESOLUTION ==========
Applying the appropriate attached patch resolves this issue.
Note that patches for released versions are generally prepared to apply to the stable branches, and may not apply cleanly to the most recent release tarball. Downstreams are encouraged to update to the tip of the stable branch before applying these patches.
xsa491.patch xen-unstable xsa491-4.21.patch Xen 4.21.x - Xen 4.17.x
$ sha256sum xsa491 23a90da1c71389083351846169fc565a671b44f5f4ba838b18fc0fa6d7582bf8 xsa491.patch 443674f42a092b953b6ba4d91cfa19bfbee0077dfcd5a39ae53368e40ed23aac xsa491-4.21.patch $
DEPLOYMENT DURING EMBARGO =========================
Deployment of the patches and/or mitigations described above (or others which are substantially similar) is permitted during the embargo, even on public-facing systems with untrusted guest users and administrators.
But: Distribution of updated software is prohibited (except to other members of the predisclosure list).
Predisclosure list members who wish to deploy significantly different patches and/or mitigations, please contact the Xen Project Security Team.
(Note: this during-embargo deployment notice is retained in post-embargo publicly released Xen Project advisories, even though it is then no longer applicable. This is to enable the community to have oversight of the Xen Project Security Team's decisionmaking.)
For more information about permissible uses of embargoed information, consult the Xen Project community's agreed Security Policy: http://www.xenproject.org/security-policy.html -----BEGIN PGP SIGNATURE-----
iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmon+4gMHHBncEB4ZW4u b3JnAAoJEIP+FMlX6CvZGqMIAJ3p3v2yhpMhVPL7ClsuYuz8ks1cVHn4d4971wCS gao1KbD+k8xjiqrR5pdCO/cHViXmajPk7sV4NwOsSmW1KQ8ejQrps3v16/IOTIjp JzcDRqk2J6IurQE819kIe0B7vQlgfElK1ZUq070DljChzBwcuWnaXywacgh/eofo SpElIHLtlM9RPmPTPaAI5inEIANb2Rrqdgt6yUg3XqSUN77h4ma8GLZH+Tt2x6Zg HN9BjZcSmcRkOwWK80g30rQ0ZltSSh0ExM5Jhk0vtulbK5BeO7dAphElwbBjAwb2 RjuoQhvS4QkvCEZGpUIiFJKtxlixhqZZl9CFYm0b4Xe/aJA= =8fKa -----END PGP SIGNATURE-----
AMD: CVE-2025-54518 CPU OP Cache Corruption
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
Xen Security Advisory CVE-2026-23558 / XSA-486 version 2
grant table v2 race in status page mapping
UPDATES IN VERSION 2 ====================
Public release.
ISSUE DESCRIPTION =================
The adjustments made for XSA-379 as well as those subsequently becoming XSA-387 still left a race window, when a HVM or PVH guest does a grant table version change from v2 to v1 in parallel with mapping the status page(s) via XENMEMaddtophysmap. Some of the status pages may then be freed while mappings of them would still be inserted into the guest's secondary (P2M) page tables.
IMPACT ======
Privilege escalation, information leaks, and Denial of Service (DoS) up to affecting the entire host cannot be excluded.
VULNERABLE SYSTEMS ==================
All Xen versions from 4.0 onwards are affected. Xen versions 3.4 and older are not affected.
Only x86 HVM and PVH guests permitted to use grant table version 2 interfaces can leverage this vulnerability. x86 PV guests cannot leverage this vulnerability. On Arm, grant table v2 use is explicitly unsupported.
MITIGATION ==========
Using the "gnttab=max-ver:1" hypervisor command line option will avoid the vulnerability.
Using the "maxgrantversion=1" guest configuration option for HVM and PVH guests will also avoid the vulnerability.
CREDITS =======
This issue was discovered by Claude Opus 4.6 and diagnosed as a security issue by Rafal Wojtczuk.
RESOLUTION ==========
Applying the appropriate attached patch resolves this issue.
Note that patches for released versions are generally prepared to apply to the stable branches, and may not apply cleanly to the most recent release tarball. Downstreams are encouraged to update to the tip of the stable branch before applying these patches.
xsa486.patch xen-unstable - Xen 4.19.x xsa486-4.18.patch Xen 4.18.x - Xen 4.17.x
$ sha256sum xsa486 0bc1336f0d8de463e30a920bb900b0199a79b4cc19af72e64cfb60504fa6599d xsa486.patch 3fa23326a2761eba62e661fa052c1cd6b69041ea6752ed573ab240ebcdffedf8 xsa486-4.18.patch $
DEPLOYMENT DURING EMBARGO =========================
Deployment of the patches described above (or others which are substantially similar) is permitted during the embargo, even on public- facing systems with untrusted guest users and administrators.
HOWEVER, deployment of the mitigation is NOT permitted (except where all the affected systems and VMs are administered and used only by organisations which are members of the Xen Project Security Issues Predisclosure List). Specifically, deployment on public cloud systems is NOT permitted.
This is because restricting the available grant table version is a guest visible configuration change, which may lead to re-discovery of the issue.
Deployment of this mitigation is permitted only AFTER the embargo ends.
AND: Distribution of updated software is prohibited (except to other members of the predisclosure list).
Predisclosure list members who wish to deploy significantly different patches and/or mitigations, please contact the Xen Project Security Team.
(Note: this during-embargo deployment notice is retained in post-embargo publicly released Xen Project advisories, even though it is then no longer applicable. This is to enable the community to have oversight of the Xen Project Security Team's decisionmaking.)
For more information about permissible uses of embargoed information, consult the Xen Project community's agreed Security Policy: http://www.xenproject.org/security-policy.html -----BEGIN PGP SIGNATURE-----
iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmnwoQMMHHBncEB4ZW4u b3JnAAoJEIP+FMlX6CvZKXgH/1/L4sRCjLuuwnugfhgcfYdOwFfWEsBGhxsuYTHT 61mqh8Ft4asiPf0qSUJzcWCpfKCB8aGBAEWDj7Hle+yAgYZ22Inf4j2emfcehXiu hkKJ+2VgYs0C4xK1mOrPysxXha9pbyNvEHBJP794QitUYIzuJzeNAcKPmzR10rZ3 jEpyLC41sGiftIB/jq579Mrvz2cp02l2L77+zeWogl7ZMLPs+GbRoF1chTrIo9DU Rt9WJnF7hD+elk280nwO2N6OCgrEVRmSR6AjsGb3E6JGUmZYJ6ZTtEaV+2TBiCXH rfrJGwftJLp6a54RRDPjK709itzppJGPG/ur2rrIRxenRcY= =1e9B -----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
Xen Security Advisory CVE-2026-23557 / XSA-484 version 2
Xenstored DoS via XSRESETWATCHES command
UPDATES IN VERSION 2 ====================
Public release.
ISSUE DESCRIPTION =================
Any guest can cause xenstored to crash by issuing a XSRESETWATCHES command within a transaction due to an assert() triggering.
In case xenstored was built with NDEBUG #defined nothing bad will happen, as assert() is doing nothing in this case. Note that the default is not to define NDEBUG for xenstored builds even in release builds of Xen.
IMPACT ======
Any unprivileged domain can cause xenstored to crash, causing a DoS (denial of service) for any Xenstore action. This will result in an inability to perform further domain administration on the host.
VULNERABLE SYSTEMS ==================
All Xen systems from Xen 4.2 onwards are vulnerable. Systems up to Xen 4.1 are not vulnerable.
Systems using the C variant of xenstored or xenstore-stubdom built without NDEBUG are vulnerable. Systems using the OCaml variant of Xenstore (oxenstored), or the C variant (xenstored or xenstore-stubdom) built with NDEBUG defined are not vulnerable.
MITIGATION ==========
There is no known mitigation available.
CREDITS =======
This issue was discovered by Andrii Sultanov of Vates.
RESOLUTION ==========
Applying the appropriate attached patch resolves this issue.
Note that patches for released versions are generally prepared to apply to the stable branches, and may not apply cleanly to the most recent release tarball. Downstreams are encouraged to update to the tip of the stable branch before applying these patches.
xsa484.patch xen-unstable - Xen 4.18.x xsa484-4.17.patch Xen 4.17.x
$ sha256sum xsa484 77c489191d40acd807eb19344a0e1bbb67a04551e89aff726fbb2006f235aacf xsa484.patch 6c8d8146d136956c59ee77da6aa6340272d1ea670a6b0d9cf37fe759d4b96b19 xsa484-4.17.patch $
DEPLOYMENT DURING EMBARGO =========================
Deployment of the patches and/or mitigations described above (or others which are substantially similar) is permitted during the embargo, even on public-facing systems with untrusted guest users and administrators.
But: Distribution of updated software is prohibited (except to other members of the predisclosure list).
Predisclosure list members who wish to deploy significantly different patches and/or mitigations, please contact the Xen Project Security Team.
(Note: this during-embargo deployment notice is retained in post-embargo publicly released Xen Project advisories, even though it is then no longer applicable. This is to enable the community to have oversight of the Xen Project Security Team's decisionmaking.)
For more information about permissible uses of embargoed information, consult the Xen Project community's agreed Security Policy: http://www.xenproject.org/security-policy.html -----BEGIN PGP SIGNATURE-----
iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmnwoQEMHHBncEB4ZW4u b3JnAAoJEIP+FMlX6CvZGVoIALBKECpaWxXD7ivkbFpFlmt9a2TOXxnD1LjbSnzI VAdyFECK4ng0uRaUXHMcd0Dkzw+dOrm/SA7jI+brumyyxsO44eLz5fysAQYXDHca qsn5h7To34Fow8ejQIt1E9DmqNlZP7Y261MhYSdWN6Z2lEa4cMPyJKA/xTpQ2uUq Cy9Ss7jrl/v98MOZb2Tkn+H8XiNsPJb57sWeaOPoUMh+42y/5qMyRgqWa3/N3iHn ZVZEhTbrNvGYKW+DUq5KswUjxw9FAmtQ1PA/w3ItWWdsb0Gd8AE02FzdIuoIt/xk zB9BEchspV1Gfouz0alFV+d4gDyclQmmViYojNfXYfKdWp8= =j/SA -----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
Xen Security Advisory XSA-488
x86: Floating Point Divider State Sampling
ISSUE DESCRIPTION =================
Researchers from the CISPA Helmholtz Center for Information Security have discovered Floating Point Divider State Sampling. It is detailed in a paper titled "TREVEX: A Black-Box Detection Framework For Data-Flow Transient Execution Vulnerabilities"
For more information, see: https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7053.html https://roots.ec/blog/fpdss/
IMPACT ======
An attacker might be able to infer data belonging to other contexts, including data belonging to other guests.
VULNERABLE SYSTEMS ==================
Systems running all versions of Xen are affected.
Only AMD Fam17h CPUs (Zen1 microarchitecture) are believed to be vulnerable. Other AMD CPUs and CPUs from other manufacturers are not known to be affected.
MITIGATION ==========
There are no mitigations.
RESOLUTION ==========
Applying the appropriate attached patch resolves this issue.
Note that patches for released versions are generally prepared to apply to the stable branches, and may not apply cleanly to the most recent release tarball. Downstreams are encouraged to update to the tip of the stable branch before applying these patches.
xsa488.patch xen-unstable - Xen 4.21.x xsa488-4.20.patch Xen 4.20.x - Xen 4.19.x xsa488-4.18.patch Xen 4.18.x xsa488-4.17.patch Xen 4.17.x
$ sha256sum xsa488 3dde61413eb75cb65fbd20b58165f673f9f4610804ec532ff0bf3c3f469454c1 xsa488.patch 7822abb0ed5a5f8e2b8697db41d46e030fd69bf8ca8cb965022484b287d9ea26 xsa488-4.17.patch 6668f9d1433863522b8554dc324f57efcfcf3e00c9261c0ee5c2db17f63bccd6 xsa488-4.18.patch 275c35d05951c4583056904869183972b9699549f0ec59f946faa92d5cef4b21 xsa488-4.20.patch $
DEPLOYMENT DURING EMBARGO =========================
Deployment of the patches and/or mitigations described above (or others which are substantially similar) is permitted during the embargo, even on public-facing systems with untrusted guest users and administrators.
But: Distribution of updated software is prohibited (except to other members of the predisclosure list).
Predisclosure list members who wish to deploy significantly different patches and/or mitigations, please contact the Xen Project Security Team.
(Note: this during-embargo deployment notice is retained in post-embargo publicly released Xen Project advisories, even though it is then no longer applicable. This is to enable the community to have oversight of the Xen Project Security Team's decisionmaking.)
For more information about permissible uses of embargoed information, consult the Xen Project community's agreed Security Policy: http://www.xenproject.org/security-policy.html -----BEGIN PGP SIGNATURE-----
iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmnhBsUMHHBncEB4ZW4u b3JnAAoJEIP+FMlX6CvZR90IAJ4bu4Ig/J4NOiTOPysLApkrzjyqrrDFqVvsUJe7 UDyll64Yuj4ljj25nDewGDG14EgdMJwqsWqM9gKl07eTzKnOxzzlsymyvX8BxiMt F7hlcsc2WW96jE2FMNpNUjoBTORQ6u+rYsG1J7Kv85PdM4KHivrXzXRswTQlGWBU d3VFnyQYE6jIGNGz1WXgA0/CxkdkTUAC0iN0NB6PSlurfkGCDqJEE3/LrTGWUEhI T30jEc4cCjfukI4YtrCiecCKtSUvzdiRZ+5ZLYrzOYePBOmGOXrxlFfHt4zE6mK0 J9IzVS5BJJVhXjQWZyoZdDgFKMlk6rTQy73hWyPNFyBUiY4= =xsxg -----END PGP SIGNATURE-----
The Intel EPT paging code uses an optimization to defer flushing of any cached EPT state until the p2m lock is dropped, so that multiple modifications done under the same locked region only issue a single flush.
Freeing of paging structures however is not deferred until the flushing is done, and can result in freed pages transiently being present in cached state. Such stale entries can point to memory ranges not owned by the guest, thus allowing access to unintended memory regions.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
Xen Security Advisory CVE-2026-23555 / XSA-481 version 2
Xenstored DoS by unprivileged domain
UPDATES IN VERSION 2 ====================
Public release.
ISSUE DESCRIPTION =================
Any guest issuing a Xenstore command accessing a node using the (illegal) node path "/local/domain/", will crash xenstored due to a clobbered error indicator in xenstored when verifying the node path.
Note that the crash is forced via a failing assert() statement in xenstored. In case xenstored is being built with NDEBUG #defined, an unprivileged guest trying to access the node path "/local/domain/" will result in it no longer being serviced by xenstored, other guests (including dom0) will still be serviced, but xenstored will use up all cpu time it can get.
IMPACT ======
Any unprivileged domain can cause xenstored to crash, causing a DoS (denial of service) for any Xenstore action. This will result in an inability to perform further domain administration on the host.
In case xenstored has been built with NDEBUG defined, an unprivileged domain can force xenstored to be 100% busy, but without harming xenstored functionality for other guests otherwise.
VULNERABLE SYSTEMS ==================
All Xen systems from Xen 4.18 onwards are vulnerable. Systems up to Xen 4.17 are not vulnerable.
Systems using the C variant of xenstored are vulnerable. Systems using xenstore-stubdom or the OCaml variant of Xenstore (oxenstored) are not vulnerable.
MITIGATION ==========
There is no known mitigation available.
CREDITS =======
This issue was discovered by Marek Marczykowski-Góreckiof Invisible Things Lab.
RESOLUTION ==========
Applying the appropriate attached patch resolves this issue.
Note that patches for released versions are generally prepared to apply to the stable branches, and may not apply cleanly to the most recent release tarball. Downstreams are encouraged to update to the tip of the stable branch before applying these patches.
xsa481.patch xen-unstable - Xen 4.18.x
$ sha256sum xsa481 148147e4545a4670578c0f24aa136f67bc203c7b18ec980b8cc80cfbb04ace68 xsa481.patch $
DEPLOYMENT DURING EMBARGO =========================
Deployment of the patch described above (or others which are substantially similar) is permitted during the embargo, even on public-facing systems with untrusted guest users and administrators.
But: Distribution of updated software is prohibited (except to other members of the predisclosure list).
Predisclosure list members who wish to deploy significantly different patches and/or mitigations, please contact the Xen Project Security Team.
Switching xenstored with oxenstored or xenstore-stubdom is not permitted as a mitigation, as this is a guest visible change of the configuration.
(Note: this during-embargo deployment notice is retained in post-embargo publicly released Xen Project advisories, even though it is then no longer applicable. This is to enable the community to have oversight of the Xen Project Security Team's decisionmaking.)
For more information about permissible uses of embargoed information, consult the Xen Project community's agreed Security Policy: http://www.xenproject.org/security-policy.html -----BEGIN PGP SIGNATURE-----
iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmm5Q1sMHHBncEB4ZW4u b3JnAAoJEIP+FMlX6CvZKmYIAKOrz2ZWyIQyEJCuci+pavN6zG8/qgBhoRhzB2gJ piwk6CDr0gB2LseEePPLbl+yoGmNxNVtXjgCNyWVbCA2HaCnPsENOOkZkUhwffN/ fXVMJHC43YdiaknKTKc8QoRn0poiPLIBQE2eXpIMVo9J7FoPkqQZYM1DS6B5x/q3 FWyKjHWwnGRv2pzRAm6mx22bu6wNpzYsfD2qCUe4d08njC3+iFLn1az+9XwF+Yw6 nS51gB2KjzRoGNhfepwzHC9R2cysYQdySFbAbskcGBTTD2FI9D+k6fBbXc7Tuj4T v+JqgQMkmQitJepE875VWxfFAR2PTRcBbL2ev6tQvA1x5mQ= =Bv72 -----END PGP SIGNATURE-----