From 675540f6bab0a7b422e13d21e67d3d285d0a9b05 Mon Sep 17 00:00:00 2001 From: Fernando Rodrigues Date: Mon, 30 Jun 2025 20:06:44 -0300 Subject: [PATCH] xen: patch with XSA-470 https://xenbits.xenproject.org/xsa/advisory-470.html Certain instructions need intercepting and emulating by Xen. In some cases Xen emulates the instruction by replaying it, using an executable stub. Some instructions may raise an exception, which is supposed to be handled gracefully. Certain replayed instructions have additional logic to set up and recover the changes to the arithmetic flags. For replayed instructions where the flags recovery logic is used, the metadata for exception handling was incorrect, preventing Xen from handling the the exception gracefully, treating it as fatal instead. An unprivileged guest can cause a hypervisor crash, causing a Denial of Service (DoS) of the entire host. Signed-off-by: Fernando Rodrigues --- pkgs/by-name/xe/xen/package.nix | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/pkgs/by-name/xe/xen/package.nix b/pkgs/by-name/xe/xen/package.nix index b0df72e7f9e6..b4fb111556e3 100644 --- a/pkgs/by-name/xe/xen/package.nix +++ b/pkgs/by-name/xe/xen/package.nix @@ -36,6 +36,10 @@ buildXenPackage.override { inherit python3Packages; } { url = "https://xenbits.xenproject.org/xsa/xsa469/xsa469-4.20-07.patch"; hash = "sha256-+BsCJa01R2lrbu7tEluGrYSAqu2jJcrpFNUoLMY466c="; }) + (fetchpatch { + url = "https://xenbits.xenproject.org/xsa/xsa470.patch"; + hash = "sha256-zhMZ6pCZtt0ocgsMFVqthMaof46lMMTaYmlepMXVJqM="; + }) ]; rev = "3ad5d648cda5add395f49fc3704b2552aae734f7"; hash = "sha256-v2DRJv+1bym8zAgU74lo1HQ/9rUcyK3qc4Eec4RpcEY=";