From 856fb3c740b70264459e5967f7ab2c964e421aef Mon Sep 17 00:00:00 2001 From: Fernando Rodrigues Date: Tue, 27 Jan 2026 22:03:24 +1100 Subject: [PATCH] xen: patch with XSA-477 Xen Security Advisory CVE-2025-58150 / XSA-477 x86: buffer overrun with shadow paging + tracing Shadow mode tracing code uses a set of per-CPU variables to avoid cumbersome parameter passing. Some of these variables are written to with guest controlled data, of guest controllable size. That size can be larger than the variable, and bounding of the writes was missing. The exact effects depend on what's adjacent to the variables in question. The most likely effects are bogus trace data, but none of privilege escalation, information leaks, or Denial of Service (DoS) can be excluded without detailed analysis of the particular build of Xen. Only x86 systems are vulnerable. Arm systems are not vulnerable. Only HVM guests running in shadow paging mode and with tracing enabled can leverage the vulnerability. Running HVM guests in HAP mode only will avoid the vulnerability. Not enabling tracing will also avoid the vulnerability. Tracing is enabled by the "tbuf_size=" command line option, or by running tools like xentrace or xenbaked in Dom0. Note that on a running system stopping xentrace / xenbaked would disable tracing. For xentrace, however, this additionally requires that it wasn't started with the -x option. Stopping previously enabled tracing can of course only prevent future damage; prior damage may have occurred and may manifest only later. This issue was discovered by Jan Beulich of SUSE. https://xenbits.xenproject.org/xsa/advisory-477.html Signed-off-by: Fernando Rodrigues --- pkgs/by-name/xe/xen/package.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/pkgs/by-name/xe/xen/package.nix b/pkgs/by-name/xe/xen/package.nix index 03c634a84b7a..3bf74621e08a 100644 --- a/pkgs/by-name/xe/xen/package.nix +++ b/pkgs/by-name/xe/xen/package.nix @@ -186,6 +186,12 @@ stdenv.mkDerivation (finalAttrs: { (replaceVars ./0002-scripts-external-executable-calls.patch scriptDeps) + # XSA #477 + (fetchpatch { + url = "https://xenbits.xenproject.org/xsa/xsa477.patch"; + hash = "sha256-c9i61GvHPiLwMGvd+5IKgUwyu/NPub+mtnxUPHW/HhI="; + }) + # patch `libxl` to search for `qemu-system-i386` properly. (Before 4.21) (fetchpatch { url = "https://github.com/xen-project/xen/commit/f6281291704aa356489f4bd927cc7348a920bd01.diff?full_index=1";