Xen Patches Cross-VM Memory Flaws; Versions 4.6 to 4.16 Unpatched
Two flaws in the Xen hypervisor let a malicious guest VM read and write the memory of other VMs on the same host, including dom0, which by default has full permissions and manages the others. The Xen Project released patches in a November 3 advisory, but only for version 4.17 and later; for 4.6 to 4.16 there is no fix and no known mitigation. According to The Hacker News, Qubes OS and XCP-ng are affected; administrators should upgrade to a patched version.
What happened
Two flaws in the Xen hypervisor let a compromised virtual machine read and modify the memory of every other machine on the same server, including dom0, the administrative VM with full permissions. The Xen Project released patches on November 3, but only for versions 4.17 and later.
Why it matters
An attacker controlling a single VM can access data from all VMs hosted on the same server, including the administrative one. Anyone running Xen 4.6 to 4.16, including products like Qubes OS and XCP-ng according to The Hacker News, has no fix and no known workaround.
What to do
Immediately apply the fixes from the November 3 advisory on hosts running Xen 4.17 or later. For versions 4.6 to 4.16, plan an upgrade, as there is no fix or known mitigation.
For the technical team
- Affected
- Xen Project Xen (hypervisor) · All Xen versions from 4.6 onward. The Hacker News lists Qubes OS and XCP-ng as affected.
- Exploitation
- No exploitation reported and no PoC cited in the sources; flaws disclosed in a Xen Project advisory.
- Fix
- Patches released for Xen 4.17 and later (November 3 advisory). No fix for versions 4.6 to 4.16; the Xen Project states there is no known mitigation.
- Vector
- Xen hypervisor; two flaws allow a malicious guest VM to read and write the memory of other VMs on the same host, including dom0, which by default has full permissions and manages the others. Condition: attacker controls a VM on the affected host.
- More details
- The Xen Project released the fixes in a November 3 advisory. According to a The Hacker News post on X, the flaws were found using Anthropic's Claude.
Timeline
Xen Project releases patches in a November 3 advisory and says there is no known mitigation; all versions from 4.6 onward are vulnerable.
Incident opened.
Sources 2 sources
- @TheHackersNews @TheHackersNews
- Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory The Hacker News
