From 91cdfbc782b908ec993dcb44a292bb69d4cb7dc2 Mon Sep 17 00:00:00 2001 From: Fernando Rodrigues Date: Tue, 13 Oct 2026 22:36:48 +1100 Subject: [PATCH] xen: patch with XSA-515 Xen Security Advisory CVE-2026-79608 / XSA-515 x86/AMD: ineffectual Zenbleed workaround The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was later re-worked to better integrate with other manipulations of the same MSR. In this rework an inverted conditional was introduced, resulting in the workaround to not be applied when needed and vice versa. For more details, see: http://xenbits.xen.org/xsa/advisory-433.html An attacker can exploit this bug to read data from different contexts on the same core. Examples of such data includes key material, cypher and plaintext from the AES-NI instructions, or the contents of REP-MOVS instructions, commonly used to implement memcpy(). https://xenbits.xenproject.org/xsa/advisory-515.html Signed-off-by: Fernando Rodrigues (cherry picked from commit 25bdf0cbd4de3bf8dd8bb7d7274ce368a7ccd853) Signed-off-by: Fernando Rodrigues --- pkgs/by-name/xe/xen/package.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/pkgs/by-name/xe/xen/package.nix b/pkgs/by-name/xe/xen/package.nix index dbf92bb8e9ee..aa8326c62293 100644 --- a/pkgs/by-name/xe/xen/package.nix +++ b/pkgs/by-name/xe/xen/package.nix @@ -209,6 +209,11 @@ stdenv.mkDerivation (finalAttrs: { url = "https://xenbits.xenproject.org/xsa/xsa512-2.patch"; hash = "sha256-4LgqC1F22kFjiVWgiSb1hZazbBF2Fziiif0Scv+ynho="; }) + + (fetchpatch { + url = "https://xenbits.xenproject.org/xsa/xsa515.patch"; + hash = "sha256-p4/eNfnR/KL1QZ+6Ml4eWyMibXr1DEcBzhQ6XrKVVhM="; + }) ] ++ optionals (versionOlder finalAttrs.version "4.21") [ # Patch `libxl` to search for `qemu-system-i386` properly.