p PatchFirst

PatchFirst · Vulnérabilités récentes

Vulnérabilités de xen · Page n° 2

Vulnérabilités publiées pour xen au cours des 30 derniers jours : 9. Présentes dans le catalogue KEV : 0.

RSS ↗ JSON ↗
Filtrer les vulnérabilités
Effacer les filtres

Vulnérabilités : 488

  1. CVE-2026-62435

    Moyenne · CVSS 6.5EPSS 0,19%Correctif disponible

    grant-table: version change racing with other operations

    [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] With the introduction of Grant Table v2 came the requirement to be able to switch between versions. Switching from v1 to v2 reduces the number of valid grant references, as a bigger shared entry structure is then needed while the shared table doesn't change size. Switching from v2 back to v1 the status frames, which are separate in v2, go away. Code holding, but intermediately dropping and then re-acquiring the grant table lock, sometimes wrongly assumes that said properties wouldn't change across the window in

    xenSystèmes d’exploitation
    • Mettez à jour vers 4.20.3+127-gc42374a105-0+deb13u1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  2. CVE-2026-62428

    Élevée · CVSS 7.8EPSS 0,11%Correctif disponible

    grant-table: type confusion in grant-copy

    When grant-copy operations are processed, the respective grant may or may not already be in use by another operation (a mapping or another copy). For all copy operations the referenced guest frame is looked up. When another operation is already active for the grant (the grant is "pinned"), what is being supplied back to actually carry out permission checks and copy operation may not be consistent: The permission check may be carried out on a page different from the one involved in the copy.

    xenSystèmes d’exploitation
    • Mettez à jour vers 4.20.3+127-gc42374a105-0+deb13u1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  3. CVE-2026-62427

    Élevée · CVSS 8.8EPSS 0,24%Correctif disponible

    sysctl and platform-op locks open to abuse

    [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these operations may not be executed in parallel, so a system-wide lock each is used. The way those locks are acquired is, however, not providing any fairness. Furthermore, with XSM/Flask in use, the lock acquire will, for some operations, occur ahead of any permission checking. The sysctl issue is CVE-2026-62426. The platform-op issue is CVE-2026-62427.

    xenSystèmes d’exploitation
    • Mettez à jour vers 4.20.3+127-gc42374a105-0+deb13u1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  4. CVE-2026-62426

    Élevée · CVSS 8.8EPSS 0,22%Correctif disponible

    sysctl and platform-op locks open to abuse

    [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these operations may not be executed in parallel, so a system-wide lock each is used. The way those locks are acquired is, however, not providing any fairness. Furthermore, with XSM/Flask in use, the lock acquire will, for some operations, occur ahead of any permission checking. The sysctl issue is CVE-2026-62426. The platform-op issue is CVE-2026-62427.

    xenSystèmes d’exploitation
    • Mettez à jour vers 4.20.3+127-gc42374a105-0+deb13u1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  5. CVE-2026-62425

    Moyenne · CVSS 5.5EPSS 0,2%Correctif disponible

    buffer overruns in libfsimage iso9660 handling

    [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them: * The directory loop itself assumes a good record length. This is CVE-2026-42494. * The calculation of the System Use area may underflow. This is CVE-2026-42495. * The Rock Ridge extension loop assumes a good (inner) record length. This is CVE-2026-62423. * The Rock Ridge NM record processing assumes a good entry length. This

    xenSystèmes d’exploitation
    • Mettez à jour vers 4.20.3+127-gc42374a105-0+deb13u1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  6. CVE-2026-62424

    Moyenne · CVSS 5.5EPSS 0,2%Correctif disponible

    buffer overruns in libfsimage iso9660 handling

    [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them: * The directory loop itself assumes a good record length. This is CVE-2026-42494. * The calculation of the System Use area may underflow. This is CVE-2026-42495. * The Rock Ridge extension loop assumes a good (inner) record length. This is CVE-2026-62423. * The Rock Ridge NM record processing assumes a good entry length. This

    xenSystèmes d’exploitation
    • Mettez à jour vers 4.20.3+127-gc42374a105-0+deb13u1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  7. CVE-2026-62423

    Moyenne · CVSS 5.5EPSS 0,2%Correctif disponible

    buffer overruns in libfsimage iso9660 handling

    [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them: * The directory loop itself assumes a good record length. This is CVE-2026-42494. * The calculation of the System Use area may underflow. This is CVE-2026-42495. * The Rock Ridge extension loop assumes a good (inner) record length. This is CVE-2026-62423. * The Rock Ridge NM record processing assumes a good entry length. This

    xenSystèmes d’exploitation
    • Mettez à jour vers 4.20.3+127-gc42374a105-0+deb13u1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  8. CVE-2026-42495

    Moyenne · CVSS 5.5EPSS 0,2%Correctif disponible

    buffer overruns in libfsimage iso9660 handling

    [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them: * The directory loop itself assumes a good record length. This is CVE-2026-42494. * The calculation of the System Use area may underflow. This is CVE-2026-42495. * The Rock Ridge extension loop assumes a good (inner) record length. This is CVE-2026-62423. * The Rock Ridge NM record processing assumes a good entry length. This

    xenSystèmes d’exploitation
    • Mettez à jour vers 4.20.3+127-gc42374a105-0+deb13u1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  9. CVE-2026-42494

    Moyenne · CVSS 6.1EPSS 0,11%Correctif disponible

    buffer overruns in libfsimage iso9660 handling

    [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them: * The directory loop itself assumes a good record length. This is CVE-2026-42494. * The calculation of the System Use area may underflow. This is CVE-2026-42495. * The Rock Ridge extension loop assumes a good (inner) record length. This is CVE-2026-62423. * The Rock Ridge NM record processing assumes a good entry length. This

    xenSystèmes d’exploitation
    • Mettez à jour vers 4.20.3+127-gc42374a105-0+deb13u1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  10. CVE-2026-42493

    Élevée · CVSS 7.5EPSS 0,45%Correctif disponible

    x86 shadow paging is deprecated

    Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has turned out overly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly available, the decision was to deprecate the functionality, while still retaining it for people to use at their own (security) risk. Memory-wise small enough guests may still be okay to run.

    xenSystèmes d’exploitation
    • Mettez à jour vers 4.20.3+127-gc42374a105-0+deb13u1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  11. CVE-2026-23556

    Critique · CVSS 9.4EPSS 0,14%Correctif disponible

    oxenstored keeps quota related use counts across domain destruction

    When oxenstored is tearing a domain down, the node data is cleaned up but the usage counts are leaked. When the domain ID is eventually reused, the new domain can create fewer nodes before beeing deemed to be over quota.

    xenSystèmes d’exploitation
    • Mettez à jour vers 4.20.3+127-gc42374a105-0+deb13u1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  12. CVE-2026-42488

    Élevée · CVSS 8.1EPSS 0,35%Correctif disponible

    x86: mismatched mapcache metadata

    Some shadow paging errors paths will switch the page-tables without updating the currently running vCPU reference. This causes a mismatch between the loaded page-tables and the mapcache metadata which can lead to corruption of the mapcache.

    xenSystèmes d’exploitation
    • Mettez à jour vers 4.20.3+127-gc42374a105-0+deb13u1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  13. CVE-2026-42490

    Moyenne · CVSS 6.5EPSS 0,2%Correctif disponible

    domctl lock open to abuse

    [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To create and manage guests, domctl operations are used by the control domain, a possible Xenstore domain, or by a domain controlling a particular guest. Some of these operations may not be executed in parallel, so a system-wide lock is used. The way that lock is acquired is, however, not providing any fairness. This is CVE-2026-42489. Furthermore, with XSM/Flask in use, the lock acquire will, for some operations, occur ahead of any permission checking. This is CVE-2026-42490.

    xenSystèmes d’exploitation
    • Mettez à jour vers 4.20.3+127-gc42374a105-0+deb13u1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  14. CVE-2026-42489

    Moyenne · CVSS 5.3EPSS 0,08%Correctif disponible

    domctl lock open to abuse

    [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To create and manage guests, domctl operations are used by the control domain, a possible Xenstore domain, or by a domain controlling a particular guest. Some of these operations may not be executed in parallel, so a system-wide lock is used. The way that lock is acquired is, however, not providing any fairness. This is CVE-2026-42489. Furthermore, with XSM/Flask in use, the lock acquire will, for some operations, occur ahead of any permission checking. This is CVE-2026-42490.

    xenSystèmes d’exploitation
    • Mettez à jour vers 4.20.3+127-gc42374a105-0+deb13u1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  15. CVE-2026-42487

    Élevée · CVSS 7.9EPSS 0,1%Correctif disponible

    x86 HVM I/O port list traversal

    HVM guest I/O port accesses are subject to either emulation or at least translation. Translations are managed by the device model (via XEN_DOMCTL_ioport_mapping), and hence the linked list used may changed at any time. Traversal of those lists (while handling guest I/O port accesses) therefore needs synchronizing with updates, which was missing so far.

    xenSystèmes d’exploitation
    • Mettez à jour vers 4.20.3+127-gc42374a105-0+deb13u1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  16. CVE-2025-10263

    Critique · CVSS 9.1EPSS 0,54%Correctif disponible

    CVE-2025-10263

    Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned by a higher exception level.

    xenSystèmes d’exploitation
    • Mettez à jour vers 4.20.3+127-gc42374a105-0+deb13u1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  17. CVE-2026-23558

    Élevée · CVSS 7.8EPSS 0,12%Correctif disponible

    grant table v2 race in status page mapping

    The adjustments made for XSA-379 as well as those subsequently becoming XSA-387 still left a race window, when a HVM or PVH guest does a grant table version change from v2 to v1 in parallel with mapping the status page(s) via XENMEM_add_to_physmap. Some of the status pages may then be freed while mappings of them would still be inserted into the guest's secondary (P2M) page tables.

    xenSystèmes d’exploitation
    • Mettez à jour vers 4.20.3+127-gc42374a105-0+deb13u1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  18. CVE-2026-23557

    Moyenne · CVSS 6.5EPSS 0,16%Correctif disponible

    Xenstored DoS via XS_RESET_WATCHES command

    Any guest can cause xenstored to crash by issuing a XS_RESET_WATCHES command within a transaction due to an assert() triggering. In case xenstored was built with NDEBUG #defined nothing bad will happen, as assert() is doing nothing in this case. Note that the default is not to define NDEBUG for xenstored builds even in release builds of Xen.

    xenSystèmes d’exploitation
    • Mettez à jour vers 4.20.3+127-gc42374a105-0+deb13u1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

Vérifiez votre serveur

Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.

Vérifiez votre serveur →