Citrix XenServer 8.4.x / 9.x Multiple Vulnerabilities (CTX697170)

The version of Citrix XenServer installed on the remote host is 8.4.x or 9.x. It is, therefore, affected by multiple vulnerabilities as referenced in the CTX697170 advisory: - A grant table race on a v2 - v1 - v2 version change may allow a privileged user in a guest VM to compromise or crash the...

tapdisk: Out-of-bounds access in tap_ctl_connect_xenblkif()

ISSUE DESCRIPTION Tapdisk is a userspace xen-blkback implementation used by the XAPI toolstack. During connection, multi-page rings may be negotiated between the frontend and backend. Tapdisk had no boundary check on the size requested by the frontend, and assumed it did not exceed 8. IMPACT A...

Out-of-bounds accesses in Tapdisk

ISSUE DESCRIPTION Tapdisk is a userspace xen-blkback implementation used by the XAPI toolstack. Several bounds checks have been found to be incorrect. There is no upper bounds check for blkif-lastsect. Passing a value larger than 7 will result in a read or write beyond the mapped grant. This is...

PT-2026-88444

News: Xen published XSA-509 to 513 at 12:00 UTC. Worst is XSA-513 CVE-2026-79605/79606: a guest can run code in tapdisk as root in dom0. Also host DoS via PCI passthrough and oxenstored. Apply vendor Xen/XAPI patches now. https://t.co/CHBHEfTqbS...