Executive brief
A vulnerability in the Xen hypervisor, a tool used to run multiple virtual machines on a single physical server, could allow a less-privileged user to disrupt the entire system. By repeatedly requesting certain system management operations, an attacker can block more important administrative tasks from completing. This can lead to a total system freeze or a significant slowdown, impacting all services running on the affected host.
Technical details
The Xen hypervisor utilizes system-wide locks for sysctl and platform operations to prevent parallel execution. However, these locks lack fairness in their acquisition mechanism. Furthermore, when XSM/Flask is enabled, the lock is acquired before permission checks are performed. A local attacker in a less-privileged domain (such as a Xenstore domain or a restricted control domain) can exploit this lack of fairness to repeatedly acquire the lock, effectively stalling more privileged entities and causing a Denial of Service (DoS) for the entire host. The issue is addressed in XSA-499 via patches that reorder permission checks and improve locking logic.
Affected products
- Xen Project Xen 4.0 and later
Timeline
- 2026-07-28: disclosed
- 2026-07-28: patched