Xen Hypervisor Flaws (XSA-523) Let Malicious VM Read/Write Memory of Other VMs, Including Dom0
The Xen Project disclosed two vulnerabilities, CVE-2026-102703 and CVE-2026-102704 (advisory XSA-523), that allow a malicious guest VM to read and write the memory of other VMs on the same host, including dom0, the privileged management VM. All Xen versions from 4.6 onward are affected; 4.5 and earlier are not. Patches are available for Xen 4.17.x through xen-unstable/4.19.x, but no fix exists for versions 4.6–4.16, several of which are past end of support. The flaws were discovered by Anthropic using its Claude model, validated by Stephan Lipp of Ada Logics, and independently reported by the CodeAnt AI Security Research Team. No in-the-wild exploitation has been reported.
Entenda a falha
A vulnerabilidade
CVE-2026-102703 and CVE-2026-102704 (advisory XSA-523) are flaws in the grant copy operation of the Xen hypervisor. A malicious guest VM can read and write the memory of other VMs on the same host, including dom0, the privileged management VM. The articles do not separate the two CVEs or say what access inside the guest an attacker needs. Every Xen version from 4.6 onward is affected; 4.5 and earlier are not. Patches exist for Xen 4.17.x through xen-unstable/4.19.x, but none for 4.6 to 4.16. The Xen Project says there is no known mitigation.
Como funciona
Each VM tells Xen which of its memory pages other VMs may use, and grant copy is the operation Xen uses to copy data between VMs after checking those permissions. When a batch of copies touches the same memory page, Xen reuses permission checks it has already made instead of repeating them. In some cases it should have checked again but did not. At that step a guest can reach memory it does not own, and the copy reads or writes it.
Por que é vulnerável
The root cause is a missing re-validation. As an optimization for batch copies within one page, Xen trusted earlier permission checks even in cases where the situation had changed and a new check was required. That wrong assumption lets the copy go beyond what the guest was granted. The articles do not explain why it went unnoticed or describe the patch in detail. This is separate from the earlier grant copy flaw XSA-500.
Onde está
The flaw is in Xen's grant copy operation, as described in advisory XSA-523; the articles name no specific file, function or commit.
Como foi descoberta
The Xen Project credited Anthropic with finding the flaws using its Claude model. Stephan Lipp of Ada Logics then validated the finding, and the CodeAnt AI Security Research Team later reported the same issue independently. The Xen Project published the advisory on November 3. No exploitation in the wild has been reported.
Explicação gerada por IA a partir da matéria e dos artigos, em 04/11/2026 10:15.
Detalhes técnicos
The bug lies in Xen's grant copy operation, used to copy data between VMs under permission checks. To optimize batch copies within the same memory page, Xen reused previously validated permission checks but in some cases failed to re-validate when required, letting a malicious guest access memory it does not own. XCP-ng warned that a single compromised guest could break out of isolation and take over the entire host. This is a separate issue from the earlier XSA-500 grant copy flaw disclosed in July 2026.
Remediação
Downstream platforms must apply XSA-523 patches: XCP-ng 8.3 released xen-4.17.7-4.2.xcpng8.3 (requires host reboot, rated Critical by Vates); Qubes OS 4.3 released Xen 4.19.6-3 for dom0 (requires dom0 restart, and Anti Evil Maid users must reseal secrets due to PCR18/PCR19 changes), currently in the security-testing repository before promotion to stable. Debian's bookworm, trixie, and forky releases remain vulnerable as of November 4, while sid is fixed. Operators running Xen 4.6–4.16 have no available patch and should consider upgrading to a supported, patched version.
Linha do tempo
-
Xen Hypervisor Flaws (XSA-523) Let Malicious VM Read/Write Memory of Other VMs, Including Dom0
ler a análise desta fonte ocultar
The Xen Project disclosed two vulnerabilities, CVE-2026-102703 and CVE-2026-102704 (advisory XSA-523), that allow a malicious guest VM to read and write the memory of other VMs on the same host, including dom0, the privileged management VM. All Xen versions from 4.6 onward are affected; 4.5 and earlier are not. Patches are available for Xen 4.17.x through xen-unstable/4.19.x, but no fix exists for versions 4.6–4.16, several of which are past end of support. The flaws were discovered by Anthropic using its Claude model, validated by Stephan Lipp of Ada Logics, and independently reported by the CodeAnt AI Security Research Team. No in-the-wild exploitation has been reported.
Technical Details
The bug lies in Xen's grant copy operation, used to copy data between VMs under permission checks. To optimize batch copies within the same memory page, Xen reused previously validated permission checks but in some cases failed to re-validate when required, letting a malicious guest access memory it does not own. XCP-ng warned that a single compromised guest could break out of isolation and take over the entire host. This is a separate issue from the earlier XSA-500 grant copy flaw disclosed in July 2026.
Remediation
Downstream platforms must apply XSA-523 patches: XCP-ng 8.3 released
xen-4.17.7-4.2.xcpng8.3(requires host reboot, rated Critical by Vates); Qubes OS 4.3 released Xen 4.19.6-3 for dom0 (requires dom0 restart, and Anti Evil Maid users must reseal secrets due to PCR18/PCR19 changes), currently in the security-testing repository before promotion to stable. Debian's bookworm, trixie, and forky releases remain vulnerable as of November 4, while sid is fixed. Operators running Xen 4.6–4.16 have no available patch and should consider upgrading to a supported, patched version.