This is necessary so an externally built oxenstored can link to the main Xen libraries.
Co-authored-by: Fernando Rodrigues <alpha@sigmasquadron.net>
Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
- Updates Xen to 4.22, which includes the new json_c requirement inherited from 4.21.
- Wraps ./configure flags in helper Nix functions.
- Fixes the missing `ocamlbuild` binary.
- Cleans up a comment left inside the script area of the `installPhase`.
Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
Co-authored-by: Yaroslav Bolyukin <iam@lach.pw>
Co-authored-by: Rane <rane+git@junkyard.systems>
Minor bugfixes. It's mostly a convenience release that rebased
all of the XSA patches we were accumulating.
Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
Xen Security Advisory XSA-508
pygrub is only supported in de-privileged mode
XSA-443 and XSA-497 addressed specific issues in specific file system
drivers (libfsimage) used by pygrub. Further issues were reported, and
yet more are to be expected. XSA-443 introduced a means to run pygrub
de-privileged. Only this mode of operation is security supported from
now on.
A guest using pygrub can escalate its privilege to that of the domain
construction tools (i.e., normally, to control of the host).
https://xenbits.xen.org/xsa/advisory-508.html
Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
Xen Security Advisory CVE-2026-62434 / XSA-507
PoD: Don't try to reclaim special pages
A guest started with Populated on Demand enabled (PoD) can attempt to
reclaim pages which aren't regular guest RAM. This can cause corruption
of memory management state in Xen.
A buggy or malicious guest can cause corruption of Xen's state, leading
to crashes or other malfunctions. Information leak and privilege
escalation cannot be ruled out.
https://xenbits.xen.org/xsa/advisory-507.html
Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
Xen Security Advisory CVE-2026-62433 / XSA-506
correct buffer checks for DM_OP hypercalls
Parts of the DM_OP handling code assumes the caller has provided the
required number of buffers for the given operation without any checking
being done. As a result, certain operations might access stack
rubble as structures are possibly uninitialized.
A device model of a HVM guest can gain insight on the contents of the
Xen stack, thus possibly leaking data from other guests contexts.
https://xenbits.xen.org/xsa/advisory-506.html
Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
Xen Security Advisory CVE-2026-62432 / XSA-505
evtchn: Race between FIFO expand and reset
The EVTCHNOP_expand_array hypercall checks for whether FIFO event
channels are enabled, but without holding the correct lock. It can race
with EVTCHNOP_reset, resulting in dereferencing a NULL pointer.
A malicious HVM guest (x86 HVM or PVH, and ARM) can crash Xen leading to
a denial of service.
A malicious x86 PV guest can most likely crash Xen leading to a denial
of service, but memory corruption or privilege escalation cannot be
ruled out.
https://xenbits.xen.org/xsa/advisory-505.html
Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
Xen Security Advisory CVE-2026-62431 / XSA-504
Viridian STIMER division by zero
The logic to handle periodic Viridian STIMERs performs a division with an
unchecked user-controller divisor value, that can be set to zero to cause a #DE
fault.
Enabling Viridian STIMERs to unprivileged HVM guests can result in a Denial
of Service (DoS) affecting the entire host.
https://xenbits.xen.org/xsa/advisory-504.html
Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
Xen Security Advisory CVE-2026-62430 / XSA-503
x86: Out-of-bounds read in vRTC emulation
Accesses to the CMOS memory contents are done using an indirect IO port
pair. Therefore Xen needs to cache the guest chosen index, and one of
the usages of the index didn't take the necessary locking to avoid
concurrent changes. As a result, a guest could change the index after
it being checked, causing a subsequent out-of-bound read access to the
contents of an array.
An attacker can read out-of-bounds, this is limited to Xen data, and not
data belonging to other guests.
https://xenbits.xen.org/xsa/advisory-503.html
Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
Xen Security Advisory CVE-2026-62429 / XSA-502
vNUMA domain cleanup may race other operations
Accessing the vNUMA configuration data of a guest is still possible when
domain destruction has already started. The cleaning up of that
configuration information is not synchronized with its retrieval by a
device model controlling the guest.
While Denial of Service (DoS) affecting the entire host and information
leaks and are the prevailing effect, a device model stub domain or a
de-privileged device model running in the control domain may also be
able to elevate its privileges to that of the host.
https://xenbits.xen.org/xsa/advisory-502.html
Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
Xen Security Advisory XSA-501
grant-table: version change racing with other operations
With the introduction of Grant Table v2 came the requirement to be able to
switch between versions. Switching from v1 to v2 reduces the number of
valid grant references, as a bigger shared entry structure is then needed
while the shared table doesn't change size. Switching from v2 back to v1
the status frames, which are separate in v2, go away.
Code holding, but intermediately dropping and then re-acquiring the grant
table lock, sometimes wrongly assumes that said properties wouldn't change
across the window in time where the lock is not being held.
The v1 -> v2 issue is CVE-2026-62435.
The v2 -> v1 issue is CVE-2026-62436.
An unprivileged guest may be able to elevate its privileges to that of the
host. Information leaks and Denial of Service (DoS) are possible as well.
https://xenbits.xen.org/xsa/advisory-501.html
Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
Xen Security Advisory CVE-2026-62428 / XSA-500
grant-table: type confusion in grant-copy
When grant-copy operations are processed, the respective grant may or may
not already be in use by another operation (a mapping or another copy).
For all copy operations the referenced guest frame is looked up. When
another operation is already active for the grant (the grant is "pinned"),
what is being supplied back to actually carry out permission checks and
copy operation may not be consistent: The permission check may be carried
out on a page different from the one involved in the copy.
An unprivileged guest may be able to elevate its privileges to that of the
host. Information leaks and Denial of Service (DoS) are possible as well.
https://xenbits.xen.org/xsa/advisory-500.html
Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
Xen Security Advisory CVE-2026-62426,CVE-2026-62427 / XSA-499
sysctl and platform-op locks open to abuse
To manage the system, sysctl and platform operations are used by the
control domain or a possible Xenstore domain. Some of these operations
may not be executed in parallel, so a system-wide lock each is used.
The way those locks are acquired is, however, not providing any fairness.
Furthermore, with XSM/Flask in use, the lock acquire will, for some
operations, occur ahead of any permission checking.
The sysctl issue is CVE-2026-62426.
The platform-op issue is CVE-2026-62427.
A less privileged entity may stall an equally or more privileged entity,
potentially leading to a Denial od Service (DoS) of up to the entire
host.
https://xenbits.xen.org/xsa/advisory-499.html
Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
Xen Security Advisory CVE-2026-42494, CVE-2026-42495, CVE-2026-62423, CVE-2026-62424, CVE-2026-62425 / XSA-497
buffer overruns in libfsimage iso9660 handling
The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver
derives several lengths directly from attacker-controlled on-disk fields
without validating them:
* The directory loop itself assumes a good record length. This is
CVE-2026-42494.
* The calculation of the System Use area may underflow. This is
CVE-2026-42495.
* The Rock Ridge extension loop assumes a good (inner) record length.
This is CVE-2026-62423.
* The Rock Ridge NM record processing assumes a good entry length.
This is CVE-2026-62424.
* The Rock Ridge CE record processing assumes a good size and offset.
This is CVE-2026-62425.
A guest using pygrub can escalate its privilege to that of the domain
construction tools (i.e., normally, to control of the host).
If the mechanism introduced by XSA-443 (see the mitigation section below)
is in use, then the guest can only escalate to this limited context.
https://xenbits.xen.org/xsa/advisory-497.html
Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
Xen Security Advisory CVE-2026-42493 / XSA-495
x86 shadow paging is deprecated
Addressing certain issues, in particular related to operations which may
take excessively long and therefore would need preemption, has turned out
overly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly
available, the decision was to deprecate the functionality, while still
retaining it for people to use at their own (security) risk. Memory-wise
small enough guests may still be okay to run.
An unprivileged guest may be able to cause Denial of Service (DoS)
affecting the entire host.
https://xenbits.xen.org/xsa/advisory-495.html
Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
Xen Security Advisory CVE-2026-42488 / XSA-494
version 3
x86: mismatched mapcache metadata
Some shadow paging errors paths will switch the page-tables without
updating the currently running vCPU reference. This causes a mismatch
between the loaded page-tables and the mapcache metadata which can lead
to corruption of the mapcache.
Privilege escalation, Denial of Service (DoS) affecting the entire host,
and information leaks.
https://xenbits.xen.org/xsa/advisory-494.html
Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
ARM-only issue. Despite us not supporting Aarch64 Xen on NixOS, it costs us
nothing to add the patches.
Xen Security Advisory CVE-2025-10263 / XSA-493
version 2
Arm: Completion of memory accesses not guaranteed by completion of a TLBI
A hardware issue has been identified in certain Arm CPU designs. A
broadcast TLBI on one PE may complete before affected memory accesses
on another PE are globally observed. This may permit bypass of Stage 1
translation, Stage 2 translation, or GPT protection.
The erratum occurs when all of the following conditions are met:
- A PE (PEx) executes a store.
- Another PE (PEy) executes a TLBI instruction which applies to
Stage 1 only information, Stage 1 and 2 information, or GPT
information (but not Stage 2 only information), applies to the
Inner Shareable or Outer Shareable domain containing PEx, and
affects at least one of the bytes accessed by PEx's store.
- PEy executes a DSB instruction which is sufficient to complete the
TLBI instruction.
- Complex micro-architectural conditions occur.
When all conditions are met, PEy's DSB may complete before the global
observation of a portion of PEx's store which was affected by the TLB
invalidation. This store may complete at a later time, after memory
accesses which are ordered after the DSB.
The relevant TLB entries are invalidated correctly before the
completion of the DSB. This erratum does not affect reads.
For more details, please refer to the Arm Security Center:
https://developer.arm.com/Arm%20Security%20Center
A malicious guest may be able to write to memory it no longer has
permission to write to, after Xen has modified Stage 2 translation to
forbid writes to that location. This could allow a guest to escalate
its privileges to that of the hypervisor.
https://xenbits.xen.org/xsa/advisory-493.html
Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
Xen Security Advisory CVE-2026-42489,CVE-2026-42490 / XSA-492
version 3
domctl lock open to abuse
To create and manage guests, domctl operations are used by the control
domain, a possible Xenstore domain, or by a domain controlling a
particular guest. Some of these operations may not be executed in
parallel, so a system-wide lock is used. The way that lock is acquired
is, however, not providing any fairness. This is CVE-2026-42489.
Furthermore, with XSM/Flask in use, the lock acquire will, for some
operations, occur ahead of any permission checking. This is
CVE-2026-42490.
A less privileged entity may stall an equally or more privileged entity,
potentially leading to a Denial od Service (DoS) of up to the entire
host.
https://xenbits.xen.org/xsa/advisory-492.html
Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
Xen Security Advisory CVE-2026-42487 / XSA-491
version 2
x86 HVM I/O port list traversal
HVM guest I/O port accesses are subject to either emulation or at least
translation. Translations are managed by the device model (via
XEN_DOMCTL_ioport_mapping), and hence the linked list used may changed
at any time. Traversal of those lists (while handling guest I/O port
accesses) therefore needs synchronizing with updates, which was missing
so far.
A device model of a HVM guest can cause a hypervisor crash, causing a
Denial of Service (DoS) of the entire host. Privilege escalation and
information leaks cannot be ruled out.
https://xenbits.xen.org/xsa/advisory-491.html
Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
Released a while ago. We had difficulties adding it to Nixpkgs at the time as
our Xen needed to be updated to the .3 release.
Xen Security Advisory CVE-2025-54518 / XSA-490
x86: CPU Opcode Cache corruption
AMD have disclosed a potential vulnerability in certain CPUs which can
cause instructions to execute at a higher privilege.
For more information, see:
https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7052.html
Code of any privilege could escalate to a higher privilege, including
userspace to kernel, and guest to host.
https://xenbits.xen.org/xsa/advisory-490.html
Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
