From 856fb3c740b70264459e5967f7ab2c964e421aef Mon Sep 17 00:00:00 2001 From: Fernando Rodrigues Date: Tue, 27 Jan 2026 22:03:24 +1100 Subject: [PATCH 1/2] xen: patch with XSA-477 Xen Security Advisory CVE-2025-58150 / XSA-477 x86: buffer overrun with shadow paging + tracing Shadow mode tracing code uses a set of per-CPU variables to avoid cumbersome parameter passing. Some of these variables are written to with guest controlled data, of guest controllable size. That size can be larger than the variable, and bounding of the writes was missing. The exact effects depend on what's adjacent to the variables in question. The most likely effects are bogus trace data, but none of privilege escalation, information leaks, or Denial of Service (DoS) can be excluded without detailed analysis of the particular build of Xen. Only x86 systems are vulnerable. Arm systems are not vulnerable. Only HVM guests running in shadow paging mode and with tracing enabled can leverage the vulnerability. Running HVM guests in HAP mode only will avoid the vulnerability. Not enabling tracing will also avoid the vulnerability. Tracing is enabled by the "tbuf_size=" command line option, or by running tools like xentrace or xenbaked in Dom0. Note that on a running system stopping xentrace / xenbaked would disable tracing. For xentrace, however, this additionally requires that it wasn't started with the -x option. Stopping previously enabled tracing can of course only prevent future damage; prior damage may have occurred and may manifest only later. This issue was discovered by Jan Beulich of SUSE. https://xenbits.xenproject.org/xsa/advisory-477.html Signed-off-by: Fernando Rodrigues --- pkgs/by-name/xe/xen/package.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/pkgs/by-name/xe/xen/package.nix b/pkgs/by-name/xe/xen/package.nix index 03c634a84b7a..3bf74621e08a 100644 --- a/pkgs/by-name/xe/xen/package.nix +++ b/pkgs/by-name/xe/xen/package.nix @@ -186,6 +186,12 @@ stdenv.mkDerivation (finalAttrs: { (replaceVars ./0002-scripts-external-executable-calls.patch scriptDeps) + # XSA #477 + (fetchpatch { + url = "https://xenbits.xenproject.org/xsa/xsa477.patch"; + hash = "sha256-c9i61GvHPiLwMGvd+5IKgUwyu/NPub+mtnxUPHW/HhI="; + }) + # patch `libxl` to search for `qemu-system-i386` properly. (Before 4.21) (fetchpatch { url = "https://github.com/xen-project/xen/commit/f6281291704aa356489f4bd927cc7348a920bd01.diff?full_index=1"; From 23711ccad7385b7ddca9b70f1d2743e675f5655e Mon Sep 17 00:00:00 2001 From: Fernando Rodrigues Date: Tue, 27 Jan 2026 22:34:17 +1100 Subject: [PATCH 2/2] xen: patch with XSA-479 Xen Security Advisory CVE-2026-23553 / XSA-479 x86: incomplete IBPB for vCPU isolation In the context switch logic Xen attempts to skip an IBPB in the case of a vCPU returning to a CPU on which it was the previous vCPU to run. While safe for Xen's isolation between vCPUs, this prevents the guest kernel correctly isolating between tasks. Consider: 1) vCPU runs on CPU A, running task 1. 2) vCPU moves to CPU B, idle gets scheduled on A. Xen skips IBPB. 3) On CPU B, guest kernel switches from task 1 to 2, issuing IBPB. 4) vCPU moves back to CPU A. Xen skips IBPB again. Now, task 2 is running on CPU A with task 1's training still in the BTB. Guest processes may leverage information leaks to obtain information intended to be private to other entities in a guest. Xen versions which had the XSA-254 fixes backported are vulnerable. Upstream, that is 4.6 and newer. Only x86 systems are vulnerable. Arm systems are not vulerable. Systems vulnerable to SRSO (see XSA-434) with default settings use IBPB-on-entry to protect against SRSO. This is a rather more aggressive form of flushing than only on context switch, and is believed to be sufficient to avoid the vulnerability. Using "spec-ctrl=ibpb-entry=hvm,ibpb-entry=pv" on the Xen command line will activate the SRSO mitigation on non-SRSO-vulnerable hardware, but it is a large overhead. This issue was discovered by David Kaplan of AMD. https://xenbits.xenproject.org/xsa/advisory-479.html Signed-off-by: Fernando Rodrigues --- pkgs/by-name/xe/xen/package.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/pkgs/by-name/xe/xen/package.nix b/pkgs/by-name/xe/xen/package.nix index 3bf74621e08a..9b1dd141fd73 100644 --- a/pkgs/by-name/xe/xen/package.nix +++ b/pkgs/by-name/xe/xen/package.nix @@ -192,6 +192,12 @@ stdenv.mkDerivation (finalAttrs: { hash = "sha256-c9i61GvHPiLwMGvd+5IKgUwyu/NPub+mtnxUPHW/HhI="; }) + # XSA #479 + (fetchpatch { + url = "https://xenbits.xenproject.org/xsa/xsa479.patch"; + hash = "sha256-2o6RYyT4Nrg1le6BUOQ3AwedorCvxvKao2uMYWrUV1Y="; + }) + # patch `libxl` to search for `qemu-system-i386` properly. (Before 4.21) (fetchpatch { url = "https://github.com/xen-project/xen/commit/f6281291704aa356489f4bd927cc7348a920bd01.diff?full_index=1";