Xen XSA-523 (CVE-2026-102703, CVE-2026-102704): guest VM can read and write other VMs' memory, including dom0
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 05/11/2026 00:03; os links antigos trazem para cá.
The Xen Project disclosed XSA-523 on 3 November 2026, covering two vulnerabilities, CVE-2026-102703 and CVE-2026-102704. CERT-FR published advisory CERTFR-2026-AVI-1447 the same day, warning of compromise of data confidentiality and integrity (cert.cyber.gouv.fr). A malicious guest VM can read and write the memory of other VMs on the same host, including dom0, the privileged management VM (thehackernews.com). The flaws were discovered by Anthropic using its Claude model, validated by Stephan Lipp of Ada Logics, and independently reported by the CodeAnt AI Security Research Team (thehackernews.com). No in-the-wild exploitation has been reported as of 4 November (thehackernews.com). Patches exist only for newer branches, and downstream vendors are releasing fixes at different paces.
Entenda a falha
A vulnerabilidade
XSA-523 covers two flaws, CVE-2026-102703 and CVE-2026-102704, in the grant copy operation of the Xen hypervisor. The articles do not separate the two or rank their severity. A malicious guest VM can read and write the memory of other VMs on the same host, including dom0, so a single compromised guest can take over the host. The advisory does not say what access inside the guest is needed, and there is no known mitigation. Xen 4.6 onward is affected (CERT-FR says versions later than 4.6; The Hacker News includes 4.6 itself), and 4.5 and earlier are not. Patches exist for xen-unstable through 4.19.x and for 4.18.x to 4.17.x, but none for 4.6 to 4.16. XCP-ng 8.3 and Qubes OS 4.3 have fixes, while Debian bookworm, trixie and forky were still vulnerable on 4 November.
Como funciona
In Xen, each VM declares which of its memory pages other VMs may use, and Xen checks those permissions. Grant copy is the operation Xen uses to copy data between VMs under those checks. When a guest submits a batch of copies that touch the same memory page, Xen reuses permission checks it already made, to save time. In some cases it should have checked again and did not, so the copy goes ahead against memory the guest does not own.
Por que é vulnerável
The root cause is a missing re-validation. As an optimization for batched copies within one page, Xen trusts earlier permission checks and, in some cases, fails to check again when it should. The articles do not say why it went unnoticed or describe the code change in the patches.
Como foi descoberta
The Xen Project credited Anthropic with finding the flaws using its Claude model. Stephan Lipp of Ada Logics then validated the finding, and the CodeAnt AI Security Research Team later reported the same issue independently. Xen published XSA-523 on 3 November 2026 and CERT-FR issued CERTFR-2026-AVI-1447 the same day. The advisory mentions no attacks exploiting the flaws, and The Hacker News reported none as of 4 November. XSA-523 is separate from XSA-500, an earlier grant copy flaw disclosed on 28 July.
Explicação gerada por IA a partir da matéria e dos artigos, em 05/11/2026 00:18.
Detalhes técnicos
- The bug is in Xen's grant copy operation, which copies data between VMs under permission checks. To optimize batch copies within the same memory page, Xen reused previously validated permission checks but in some cases failed to re-validate when required. A malicious guest could then access memory it does not own (thehackernews.com).
- XCP-ng warned that a single compromised guest could escape isolation and take over the entire host (thehackernews.com).
- This is separate from the earlier XSA-500 grant copy flaw disclosed in July 2026 (thehackernews.com).
- Impact is on data confidentiality and integrity (cert.cyber.gouv.fr).
- Affected: Xen 4.6 and later; 4.5 and earlier are not affected (thehackernews.com).
Remediação
- Apply the patches referenced in the XSA-523 bulletin (cert.cyber.gouv.fr).
- Patches are available for Xen 4.17.x through xen-unstable/4.19.x. No fix exists for 4.6–4.16, several of which are past end of support. Operators on those branches should upgrade to a supported, patched version (thehackernews.com).
- XCP-ng 8.3:
xen-4.17.7-4.2.xcpng8.3, which requires a host reboot and is rated Critical by Vates (thehackernews.com). - Qubes OS 4.3: Xen 4.19.6-3 for dom0, which requires a dom0 restart. It was in the security-testing repository, pending promotion to stable. Anti Evil Maid users must reseal secrets because PCR18/PCR19 change (thehackernews.com).
- Debian bookworm, trixie and forky remained vulnerable as of 4 November, while sid is fixed (thehackernews.com).
Relatos divergentes
- Affected versions: CERT-FR says versions "later than 4.6" without the latest patch are affected (cert.cyber.gouv.fr). The Hacker News says 4.6 itself and all later versions are affected (thehackernews.com). The Hacker News is more detailed and the more recent source, published 4 November.
- Patch availability: CERT-FR simply advises applying the XSA-523 patches (cert.cyber.gouv.fr). The Hacker News reports that no patch exists for 4.6–4.16 (thehackernews.com). Check the Xen advisory directly for the branch you run.
Linha do tempo
-
CERT-FR Advisory: Multiple Vulnerabilities in Xen Hypervisor Expose Data Confidentiality and Integrity
ler a análise desta fonte ocultar
CERT-FR issued advisory CERTFR-2026-AVI-1447 on 03 November 2026 covering multiple vulnerabilities in Xen affecting all versions later than 4.6 without the latest security patch. The flaws allow an attacker to compromise data confidentiality and data integrity. CERT-FR references the official Xen security advisory XSA-523 published the same day and lists two associated CVE identifiers.
Technical Details
- Vulnerabilities impact data confidentiality and data integrity.
- Affected: Xen versions later than 4.6 without the latest security correctif.
- Two CVEs assigned: CVE-2026-102703, CVE-2026-102704.
- Referenced source: Xen security bulletin XSA-523 (03 November 2026).
Remediation
- Apply the patches referenced in the Xen XSA-523 security bulletin.
-
Xen Hypervisor Flaws (XSA-523) Let Malicious VM Read/Write Memory of Other VMs, Including Dom0
ler a análise desta fonte ocultar
The Xen Project disclosed two vulnerabilities, CVE-2026-102703 and CVE-2026-102704 (advisory XSA-523), that allow a malicious guest VM to read and write the memory of other VMs on the same host, including dom0, the privileged management VM. All Xen versions from 4.6 onward are affected; 4.5 and earlier are not. Patches are available for Xen 4.17.x through xen-unstable/4.19.x, but no fix exists for versions 4.6–4.16, several of which are past end of support. The flaws were discovered by Anthropic using its Claude model, validated by Stephan Lipp of Ada Logics, and independently reported by the CodeAnt AI Security Research Team. No in-the-wild exploitation has been reported.
Technical Details
The bug lies in Xen's grant copy operation, used to copy data between VMs under permission checks. To optimize batch copies within the same memory page, Xen reused previously validated permission checks but in some cases failed to re-validate when required, letting a malicious guest access memory it does not own. XCP-ng warned that a single compromised guest could break out of isolation and take over the entire host. This is a separate issue from the earlier XSA-500 grant copy flaw disclosed in July 2026.
Remediation
Downstream platforms must apply XSA-523 patches: XCP-ng 8.3 released
xen-4.17.7-4.2.xcpng8.3(requires host reboot, rated Critical by Vates); Qubes OS 4.3 released Xen 4.19.6-3 for dom0 (requires dom0 restart, and Anti Evil Maid users must reseal secrets due to PCR18/PCR19 changes), currently in the security-testing repository before promotion to stable. Debian's bookworm, trixie, and forky releases remain vulnerable as of November 4, while sid is fixed. Operators running Xen 4.6–4.16 have no available patch and should consider upgrading to a supported, patched version.