rpm package
opensuse/xen&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/xen&distro=openSUSE%20Tumbleweed
Vulnerabilities (291)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-62434 | Med | 5.3 | < 4.22.0_02-1.1 | 4.22.0_02-1.1 | Jul 28, 2026 | A guest started with Populated on Demand enabled (PoD) can attempt to reclaim pages which aren't regular guest RAM. This can cause corruption of memory management state in Xen. | |
| CVE-2026-62433 | Hig | 7.3 | < 4.22.0_02-1.1 | 4.22.0_02-1.1 | Jul 28, 2026 | Parts of the DM_OP handling code assumes the caller has provided the required number of buffers for the given operation without any checking being done. As a result, certain operations might access stack rubble as structures are possibly uninitialized. | |
| CVE-2026-62432 | Hig | 7.3 | < 4.22.0_02-1.1 | 4.22.0_02-1.1 | Jul 28, 2026 | The EVTCHNOP_expand_array hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOP_reset, resulting in dereferencing a NULL pointer. | |
| CVE-2026-62431 | Hig | 7.5 | < 4.22.0_02-1.1 | 4.22.0_02-1.1 | Jul 28, 2026 | The logic to handle periodic Viridian STIMERs performs a division with an unchecked user-controlled divisor value, that can be set to zero to cause a #DE fault. | |
| CVE-2026-62430 | Hig | 7.5 | < 4.22.0_02-1.1 | 4.22.0_02-1.1 | Jul 28, 2026 | Accesses to the CMOS memory contents are done using an indirect IO port pair. Therefore Xen needs to cache the guest chosen index, and one of the usages of the index didn't take the necessary locking to avoid concurrent changes. As a result, a guest could change the index after | |
| CVE-2026-62429 | Med | 6.5 | < 4.22.0_02-1.1 | 4.22.0_02-1.1 | Jul 28, 2026 | Accessing the vNUMA configuration data of a guest is still possible when domain destruction has already started. The cleaning up of that configuration information is not synchronized with its retrieval by a device model controlling the guest. | |
| CVE-2026-62428 | Hig | 7.8 | < 4.22.0_02-1.1 | 4.22.0_02-1.1 | Jul 28, 2026 | When grant-copy operations are processed, the respective grant may or may not already be in use by another operation (a mapping or another copy). For all copy operations the referenced guest frame is looked up. When another operation is already active for the grant (the grant is | |
| CVE-2026-62426 | Hig | 8.8 | < 4.22.0_02-1.1 | 4.22.0_02-1.1 | Jul 28, 2026 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these operations may not b | |
| CVE-2026-62423 | Med | 5.5 | < 4.22.0_02-1.1 | 4.22.0_02-1.1 | Jul 28, 2026 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields witho | |
| CVE-2026-42494 | Med | 6.1 | < 4.22.0_02-1.1 | 4.22.0_02-1.1 | Jul 28, 2026 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields witho | |
| CVE-2026-42493 | Hig | 7.5 | < 4.22.0_02-1.1 | 4.22.0_02-1.1 | Jul 28, 2026 | Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has turned out overly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly available, the decision was to deprecate the functionality, | |
| CVE-2026-42492 | Hig | 7.5 | < 4.22.0_02-1.1 | 4.22.0_02-1.1 | Jul 28, 2026 | Xenstore, to have an up-to-date picture of the entire system, wants to know of domains appearing and disappearing. To make this more robust, a new XEN_DOMCTL_get_domain_state was introduced. The management of the bitmap underlying that operation is tied into the binding of the | |
| CVE-2026-23558 | Hig | 7.8 | < 4.21.1_04-1.1 | 4.21.1_04-1.1 | May 19, 2026 | The adjustments made for XSA-379 as well as those subsequently becoming XSA-387 still left a race window, when a HVM or PVH guest does a grant table version change from v2 to v1 in parallel with mapping the status page(s) via XENMEM_add_to_physmap. Some of the status pages may t | |
| CVE-2026-23557 | Med | 6.5 | < 4.21.1_04-1.1 | 4.21.1_04-1.1 | May 19, 2026 | Any guest can cause xenstored to crash by issuing a XS_RESET_WATCHES command within a transaction due to an assert() triggering. In case xenstored was built with NDEBUG #defined nothing bad will happen, as assert() is doing nothing in this case. Note that the default is not to d | |
| CVE-2025-54518 | Hig | 7.0 | < 4.21.1_06-1.1 | 4.21.1_06-1.1 | May 15, 2026 | Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instructions executed at a different privilege level, potentially resulting in privilege escalation. | |
| CVE-2026-23555 | Hig | 7.1 | < 4.21.1_02-1.1 | 4.21.1_02-1.1 | Mar 23, 2026 | Any guest issuing a Xenstore command accessing a node using the (illegal) node path "/local/domain/", will crash xenstored due to a clobbered error indicator in xenstored when verifying the node path. Note that the crash is forced via a failing assert() statement in xenstored. I | |
| CVE-2026-23554 | Hig | 7.8 | < 4.21.1_02-1.1 | 4.21.1_02-1.1 | Mar 23, 2026 | The Intel EPT paging code uses an optimization to defer flushing of any cached EPT state until the p2m lock is dropped, so that multiple modifications done under the same locked region only issue a single flush. Freeing of paging structures however is not deferred until the flus | |
| CVE-2026-23553 | Low | 2.9 | < 4.21.0_04-1.1 | 4.21.0_04-1.1 | Jan 28, 2026 | In the context switch logic Xen attempts to skip an IBPB in the case of a vCPU returning to a CPU on which it was the previous vCPU to run. While safe for Xen's isolation between vCPUs, this prevents the guest kernel correctly isolating between tasks. Consider: 1) vCPU runs on | |
| CVE-2025-58150 | Hig | 8.8 | < 4.21.0_04-1.1 | 4.21.0_04-1.1 | Jan 28, 2026 | Shadow mode tracing code uses a set of per-CPU variables to avoid cumbersome parameter passing. Some of these variables are written to with guest controlled data, of guest controllable size. That size can be larger than the variable, and bounding of the writes was missing. | |
| CVE-2025-58149 | Hig | 7.5 | < 4.20.1_08-1.1 | 4.20.1_08-1.1 | Oct 31, 2025 | When passing through PCI devices, the detach logic in libxl won't remove access permissions to any 64bit memory BARs the device might have. As a result a domain can still have access any 64bit memory BAR when such device is no longer assigned to the domain. For PV domains the p |
- affected < 4.22.0_02-1.1fixed 4.22.0_02-1.1
A guest started with Populated on Demand enabled (PoD) can attempt to reclaim pages which aren't regular guest RAM. This can cause corruption of memory management state in Xen.
- affected < 4.22.0_02-1.1fixed 4.22.0_02-1.1
Parts of the DM_OP handling code assumes the caller has provided the required number of buffers for the given operation without any checking being done. As a result, certain operations might access stack rubble as structures are possibly uninitialized.
- affected < 4.22.0_02-1.1fixed 4.22.0_02-1.1
The EVTCHNOP_expand_array hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOP_reset, resulting in dereferencing a NULL pointer.
- affected < 4.22.0_02-1.1fixed 4.22.0_02-1.1
The logic to handle periodic Viridian STIMERs performs a division with an unchecked user-controlled divisor value, that can be set to zero to cause a #DE fault.
- affected < 4.22.0_02-1.1fixed 4.22.0_02-1.1
Accesses to the CMOS memory contents are done using an indirect IO port pair. Therefore Xen needs to cache the guest chosen index, and one of the usages of the index didn't take the necessary locking to avoid concurrent changes. As a result, a guest could change the index after
- affected < 4.22.0_02-1.1fixed 4.22.0_02-1.1
Accessing the vNUMA configuration data of a guest is still possible when domain destruction has already started. The cleaning up of that configuration information is not synchronized with its retrieval by a device model controlling the guest.
- affected < 4.22.0_02-1.1fixed 4.22.0_02-1.1
When grant-copy operations are processed, the respective grant may or may not already be in use by another operation (a mapping or another copy). For all copy operations the referenced guest frame is looked up. When another operation is already active for the grant (the grant is
- affected < 4.22.0_02-1.1fixed 4.22.0_02-1.1
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these operations may not b
- affected < 4.22.0_02-1.1fixed 4.22.0_02-1.1
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields witho
- affected < 4.22.0_02-1.1fixed 4.22.0_02-1.1
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields witho
- affected < 4.22.0_02-1.1fixed 4.22.0_02-1.1
Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has turned out overly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly available, the decision was to deprecate the functionality,
- affected < 4.22.0_02-1.1fixed 4.22.0_02-1.1
Xenstore, to have an up-to-date picture of the entire system, wants to know of domains appearing and disappearing. To make this more robust, a new XEN_DOMCTL_get_domain_state was introduced. The management of the bitmap underlying that operation is tied into the binding of the
- affected < 4.21.1_04-1.1fixed 4.21.1_04-1.1
The adjustments made for XSA-379 as well as those subsequently becoming XSA-387 still left a race window, when a HVM or PVH guest does a grant table version change from v2 to v1 in parallel with mapping the status page(s) via XENMEM_add_to_physmap. Some of the status pages may t
- affected < 4.21.1_04-1.1fixed 4.21.1_04-1.1
Any guest can cause xenstored to crash by issuing a XS_RESET_WATCHES command within a transaction due to an assert() triggering. In case xenstored was built with NDEBUG #defined nothing bad will happen, as assert() is doing nothing in this case. Note that the default is not to d
- affected < 4.21.1_06-1.1fixed 4.21.1_06-1.1
Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instructions executed at a different privilege level, potentially resulting in privilege escalation.
- affected < 4.21.1_02-1.1fixed 4.21.1_02-1.1
Any guest issuing a Xenstore command accessing a node using the (illegal) node path "/local/domain/", will crash xenstored due to a clobbered error indicator in xenstored when verifying the node path. Note that the crash is forced via a failing assert() statement in xenstored. I
- affected < 4.21.1_02-1.1fixed 4.21.1_02-1.1
The Intel EPT paging code uses an optimization to defer flushing of any cached EPT state until the p2m lock is dropped, so that multiple modifications done under the same locked region only issue a single flush. Freeing of paging structures however is not deferred until the flus
- affected < 4.21.0_04-1.1fixed 4.21.0_04-1.1
In the context switch logic Xen attempts to skip an IBPB in the case of a vCPU returning to a CPU on which it was the previous vCPU to run. While safe for Xen's isolation between vCPUs, this prevents the guest kernel correctly isolating between tasks. Consider: 1) vCPU runs on
- affected < 4.21.0_04-1.1fixed 4.21.0_04-1.1
Shadow mode tracing code uses a set of per-CPU variables to avoid cumbersome parameter passing. Some of these variables are written to with guest controlled data, of guest controllable size. That size can be larger than the variable, and bounding of the writes was missing.
- affected < 4.20.1_08-1.1fixed 4.20.1_08-1.1
When passing through PCI devices, the detach logic in libxl won't remove access permissions to any 64bit memory BARs the device might have. As a result a domain can still have access any 64bit memory BAR when such device is no longer assigned to the domain. For PV domains the p
Page 1 of 15