Executive brief
Multiple vulnerabilities in the Xen Project's XAPI management tool can allow a guest administrator or authenticated user to crash the management service. By providing specially crafted text input, an attacker can cause the database to stop processing events or prevent the system from restarting correctly. This results in a denial-of-service condition that disrupts the management of virtual machines and may require manual database repair to restore operations.
Technical details
Xen XAPI contains three distinct vulnerabilities related to string handling and database updates. First, a logic error exists where unsanitized input is used for notifications despite being sanitized for the database, causing the event thread to crash. Second, a Unicode version mismatch (v3.0 vs v3.1) allows XAPI to accept strings that are later rejected by stricter libraries, leading to a database that cannot be reloaded and causing a restart loop. Third, Map/Set updates lack proper input sanitization. These issues can be exploited by guest administrators or authenticated API users to cause a permanent Denial of Service. Patches are available, though manual database intervention using 'iconv' may be required if corrupt strings were already committed to the state database.
Affected products
- Xen Project XAPI All versions
Timeline
- 2025-09-09: disclosed: Initial public release of XSA-474
- 2025-09-09: patched
- 2026-07-09: advisory: NVD publication date