x86: Out-of-bounds read in vRTC emulation

ISSUE DESCRIPTION Accesses to the CMOS memory contents are done using an indirect IO port pair. Therefore Xen needs to cache the guest chosen index, and one of the usages of the index didn't take the necessary locking to avoid concurrent changes. As a result, a guest could change the index after ...

Viridian STIMER division by zero

ISSUE DESCRIPTION The logic to handle periodic Viridian STIMERs performs a division with an unchecked user-controlled divisor value, that can be set to zero to cause a DE fault. IMPACT Enabling Viridian STIMERs to unprivileged HVM guests can result in a Denial of Service DoS affecting the entire...

grant-table: type confusion in grant-copy

ISSUE DESCRIPTION When grant-copy operations are processed, the respective grant may or may not already be in use by another operation a mapping or another copy. For all copy operations the referenced guest frame is looked up. When another operation is already active for the grant the grant is...

sysctl and platform-op locks open to abuse

ISSUE DESCRIPTION To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these operations may not be executed in parallel, so a system-wide lock each is used. The way those locks are acquired is, however, not providing any...

domctl lock open to abuse

ISSUE DESCRIPTION To create and manage guests, domctl operations are used by the control domain, a possible Xenstore domain, or by a domain controlling a particular guest. Some of these operations may not be executed in parallel, so a system-wide lock is used. The way that lock is acquired is,...

Astra Linux – Vulnerability in Xen

A issue was discovered in Xen versions 4.9 through 4.14.x. On the ARM architecture, a guest can control whether memory accesses bypass the cache. This means that Xen needs to ensure that all writes such as those during scrubbing have reached the memory before handing over the page to the guest...

x86: CPU Opcode Cache corruption

ISSUE DESCRIPTION AMD have disclosed a potential vulnerability in certain CPUs which can cause instructions to execute at a higher privilege. For more information, see: https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7052.html IMPACT Code of any privilege could escalate to a...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001959)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001959 advisory. Xen 3.3.x through 4.5.x and the Linux kernel through 3.19.1 do not properly restrict access to PCI command registers, which might allow local guest OS users to cause...

EUVD-2012-5518

Malware in sbrugna...

EUVD-2016-7189

Malware in sbrugna...

EUVD-2013-4413

Malware in sbrugna...

EUVD-2014-3953

Malware in sbrugna...

EUVD-2014-1955

Malware in sbrugna...

EUVD-2013-4293

Malware in sbrugna...

EUVD-2015-2846

Malware in sbrugna...

EUVD-2013-2057

Malware in sbrugna...

EUVD-2015-4130

Malware in sbrugna...

EUVD-2015-7710

Malware in sbrugna...

EUVD-2015-7868

Malware in sbrugna...

Arm issues with page refcounting

ISSUE DESCRIPTION There are two issues related to the mapping of pages belonging to other domains: For one, an assertion is wrong there, where the case actually needs handling. A NULL pointer de-reference could result on a release build. This is CVE-2025-58144. And then the P2M lock isn't held...