Xen Flaws Could Let a Malicious VM Access Other Virtual Machines’ Memory - Cybersecurity

Two vulnerabilities affecting Xen 4.6 and later could allow a guest VM to read and write memory belonging to other VMs on the same host, including dom0. The Xen Project has published patches, but says no mitigation is available.

Two flaws in the Xen hypervisor could allow a malicious guest virtual machine to read and modify memory belonging to other VMs on the same host, including dom0, the management VM that typically has broad permissions. The Xen Project disclosed the vulnerabilities in advisory XSA-523 on November 3 and said patches are available, with no known mitigation.

Tracked as CVE-2026-102703 and CVE-2026-102704, the flaws affect Xen 4.6 and later; versions 4.5 and earlier are not affected. They stem from grant copy, the mechanism Xen uses to transfer data between VMs. Xen checks which memory pages a VM permits others to use, but can reuse checks when processing batches of copies. In some cases, it failed to repeat a check when necessary, potentially allowing access to memory a guest does not own.

The Xen Project credited Anthropic with discovering the flaws using its Claude model. Stephan Lipp of Ada Logics validated the finding, and the CodeAnt AI Security Research Team independently reported the issue. The advisory does not identify any known attacks or specify what level of access within a VM would be required to exploit the flaws.

XCP-ng, a virtualization platform based on Xen, warned in its update notes that a compromised guest could escape its isolation and take control of the host. Its version 8.3 update, released November 3, includes Xen package xen-4.17.7-4.2.xcpng8.3, and hosts must be rebooted to apply the fix. Vates, which supports XCP-ng, rates the impact as critical.

Qubes OS said all supported releases and configurations are affected. Its fix is for Qubes 4.3, the only release it continues to support, and updates Xen packages in dom0 to version 4.19.6-3. Applying the update requires restarting dom0. Users of Anti Evil Maid must also reseal their secret passphrase because the new Xen binaries change PCR18 and PCR19. Qubes initially made the fixed packages available through its security-testing repository, with a move to the stable repository planned after community testing.

The Xen advisory provides patches for xen-unstable through Xen 4.19.x, as well as for Xen 4.18.x and 4.17.x. It does not provide patches for Xen 4.6 to 4.16; security support for Xen 4.16 ended on December 2, 2024. Other products using vulnerable Xen versions may also be affected until their maintainers apply the XSA-523 fixes. As of November 4, Debian’s security tracker listed the xen package as vulnerable in bookworm, trixie, and forky, and fixed in sid.

XSA-523 is separate from XSA-500, another Xen grant copy vulnerability disclosed on July 28, and has its own patches.

Sources: The Hacker News.