Executive brief
A security vulnerability exists in varstored, a component of the Xen Xapi toolstack that manages UEFI variables for virtual machines. An attacker with administrative or kernel-level access within a guest virtual machine can exploit this flaw to escape the virtual environment and execute unauthorized code on the host system. This could lead to a total compromise of the virtualization platform and any other virtual machines running on the same hardware.
Technical details
The vulnerability is a Time-of-Check Time-of-Use (TOCTOU) race condition in varstored, a component of the Xapi toolstack. The root cause is insufficient compiler barriers when handling a shared memory buffer mapped between varstored and the guest's OVMF. An attacker with kernel-level access in an x86 HVM guest configured with UEFI firmware can manipulate data in the shared buffer after it has been validated but before it is used. In default builds, this allows an attacker to control a jump table index, leading to arbitrary code execution within the context of varstored. A patch is available from the Xen Project (XSA-478).
Affected products
- Xen Project varstored All versions
Timeline
- 2026-01-27: disclosed: Initial public release of XSA-478
- 2026-01-27: patched: Patch xsa478.patch released
- 2026-07-09: advisory: NVD publication date