cve-2024-8069-exp-Citrix-Virtual-Apps-XEN

CVE-2024-8068 and CVE-2024-8069 Citrix Virtual Apps and Desktops XEN Unauthenticated Remote Code Execution Vulnerability Check out our blog post for detailed technical information. https://github.com/user-attachments/assets/563fd110-5321-49f7-8dc3-48eb0a53e0f9 Exploit Demonstration python...

xen

\ / / | | | | | | \ // \ ' \ | | | | ' / | / | ' | |/ / \ / | | | | || | | | \ || | | | | | / / /|| | | , || | |/ , |./| || https://www.xen.org/ What is Xen? Xen is a Virtual Machine Monitor VMM originally developed by the Systems Research Group of the University of Cambridge Computer Laboratory,...

Citrix-Virtual-Apps-XEN-Exploit

CVE-2024-xxxx Citrix Virtual Apps and Desktops XEN Unauthenticated Remote Code execution See our blog post for technical details https://github.com/user-attachments/assets/563fd110-5321-49f7-8dc3-48eb0a53e0f9 PoC in Action python exploit-citrix-xen.py --target 192.168.1.120 --port 80 --cmd "whoam...

CVE-2026-31787

XSA-487 / CVE-2026-31787 Linux kernel double free in Xen privcmd driver A double free of kernel memory in the Linux kernel's Xen privcmd driver allows circumvention of kernel lockdown secure boot. Exploitation requires root-level access, which limits the broader security implications. | ---|---...

SUSE CVE-2026-99286

In the Linux kernel, the following vulnerability has been resolved: xen-netback: Fix XenBus connection failure cleanup xenvifgetstats and xenvifgetethtoolstats capture vif-numqueues under rcureadlock. We need to unpublish vif-numqueues before synchronizenet to ensure that readers that come...

SUSE CVE-2026-99287

In the Linux kernel, the following vulnerability has been resolved: xen-netback: Zero out sring pointers on unmap If xenvifmapfrontenddatarings fails when a ring is already mapped, it unmaps them via xenvifunmapfrontenddatarings which keeps the ring pointers unchanged. xenvifconnectdata's cleanup...

CVE-2026-99287

A flaw was found in the Linux kernel's Xen network backend xen-netback driver. When an error occurs while mapping communication rings for a guest domain, the driver fails to clear the ring pointers after unmapping them, causing the cleanup routine to unmap the same memory pointers a second time. ...

CVE-2026-99286

A flaw was found in the Linux kernel's xen-netback driver. During a virtual network connection failure, the driver deallocates queue resources before resetting the active queue count. A local user or guest domain could exploit this race condition by requesting network statistics during cleanup,...

CVE-2026-99287

In the Linux kernel, the following vulnerability has been resolved: xen-netback: Zero out sring pointers on unmap If xenvifmapfrontenddatarings fails when a ring is already mapped, it unmaps them via xenvifunmapfrontenddatarings which keeps the ring pointers unchanged. xenvifconnectdata's cleanup...

CVE-2026-99286

In the Linux kernel, the following vulnerability has been resolved: xen-netback: Fix XenBus connection failure cleanup xenvifgetstats and xenvifgetethtoolstats capture vif-numqueues under rcureadlock. We need to unpublish vif-numqueues before synchronizenet to ensure that readers that come...

CVE-2026-99287

In the Linux kernel, the following vulnerability has been resolved: xen-netback: Zero out sring pointers on unmap If xenvifmapfrontenddatarings fails when a ring is already mapped, it unmaps them via xenvifunmapfrontenddatarings which keeps the ring pointers unchanged. xenvifconnectdata's cleanup...

CVE-2026-99286

In the Linux kernel, the following vulnerability has been resolved: xen-netback: Fix XenBus connection failure cleanup xenvifgetstats and xenvifgetethtoolstats capture vif-numqueues under rcureadlock. We need to unpublish vif-numqueues before synchronizenet to ensure that readers that come...

Linux Distros Unpatched Vulnerability : CVE-2026-0004

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - linux - None xen - None CVE-2026-0004 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C...

UBUNTU-CVE-2026-99286

In the Linux kernel, the following vulnerability has been resolved: xen-netback: Fix XenBus connection failure cleanup xenvifgetstats and xenvifgetethtoolstats capture vif-numqueues under rcureadlock. We need to unpublish vif-numqueues before synchronizenet to ensure that readers that come...

UBUNTU-CVE-2026-99287

In the Linux kernel, the following vulnerability has been resolved: xen-netback: Zero out sring pointers on unmap If xenvifmapfrontenddatarings fails when a ring is already mapped, it unmaps them via xenvifunmapfrontenddatarings which keeps the ring pointers unchanged. xenvifconnectdata's cleanup...

AZL-113317 CVE-2026-99287 affecting package kernel 6.6.161.1-1

In the Linux kernel, the following vulnerability has been resolved: xen-netback: Zero out sring pointers on unmap If xenvifmapfrontenddatarings fails when a ring is already mapped, it unmaps them via xenvifunmapfrontenddatarings which keeps the ring pointers unchanged. xenvifconnectdata's cleanup...

CVE-2026-99287

In the Linux kernel, the following vulnerability has been resolved: xen-netback: Zero out sring pointers on unmap If xenvifmapfrontenddatarings fails when a ring is already mapped, it unmaps them via xenvifunmapfrontenddatarings which keeps the ring pointers unchanged. xenvifconnectdata's cleanup...

AZL-113314 CVE-2026-99286 affecting package kernel 6.6.161.1-1

In the Linux kernel, the following vulnerability has been resolved: xen-netback: Fix XenBus connection failure cleanup xenvifgetstats and xenvifgetethtoolstats capture vif-numqueues under rcureadlock. We need to unpublish vif-numqueues before synchronizenet to ensure that readers that come...

CVE-2026-99286

In the Linux kernel, the following vulnerability has been resolved: xen-netback: Fix XenBus connection failure cleanup xenvifgetstats and xenvifgetethtoolstats capture vif-numqueues under rcureadlock. We need to unpublish vif-numqueues before synchronizenet to ensure that readers that come...

Linux xen-netback: guest can trigger use-after-free for network statistics reads

ISSUE DESCRIPTION The network statistic data in the driver is protected by RCU. Unfortunately when tearing down the queues after an error during connecting to the frontend e.g. due to illegal Xenstore data filled in by the guest, there was missing RCU synchronization before freeing the memory...