From 901ddad0838f69134e863579d140b2d0d28db46e Mon Sep 17 00:00:00 2001 From: Fernando Rodrigues Date: Tue, 21 Oct 2025 22:57:19 +1100 Subject: [PATCH] xen: patch with XSA-475 Xen Security Advisory #475 x86: Incorrect input sanitisation in Viridian hypercalls Some Viridian hypercalls can specify a mask of vCPU IDs as an input, in one of three formats. Xen has boundary checking bugs with all three formats, which can cause out-of-bounds reads and writes while processing the inputs. * CVE-2025-58147. Hypercalls using the HV_VP_SET Sparse format can cause vpmask_set() to write out of bounds when converting the bitmap to Xen's format. * CVE-2025-58148. Hypercalls using any input format can cause send_ipi() to read d->vcpu[] out-of-bounds, and operate on a wild vCPU pointer. Signed-off-by: Fernando Rodrigues --- pkgs/by-name/xe/xen/package.nix | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/pkgs/by-name/xe/xen/package.nix b/pkgs/by-name/xe/xen/package.nix index 152ecf6fdd5b..e5910918c62f 100644 --- a/pkgs/by-name/xe/xen/package.nix +++ b/pkgs/by-name/xe/xen/package.nix @@ -215,6 +215,16 @@ stdenv.mkDerivation (finalAttrs: { url = "https://xenbits.xen.org/xsa/xsa473-2.patch"; hash = "sha256-tGuIGxJFBXbckIruSUeTyrM6GabdIj6Pr3cVxeDvNNY="; }) + + # XSA 475 + (fetchpatch { + url = "https://xenbits.xen.org/xsa/xsa475-1.patch"; + hash = "sha256-Bzvtr12g+7+M9jY9Nt2jd41CwYTL+h2fuwzJFsxroio="; + }) + (fetchpatch { + url = "https://xenbits.xen.org/xsa/xsa475-2.patch"; + hash = "sha256-7MKtDAJpihpfcBK+hyBFGCP6gHWs2cdgTks8B439b2s="; + }) ]; outputs = [