Executive brief
A vulnerability in the Xen hypervisor, which is software used to run multiple virtual machines on a single physical server, could allow a user with limited privileges to interfere with more powerful administrative accounts. By exploiting how the system manages internal locks for platform operations, an attacker could cause the entire server to become unresponsive or slow down significantly. This results in a denial-of-service condition that can disrupt all services and data hosted on the affected physical hardware.
Technical details
A vulnerability exists in the Xen hypervisor's handling of platform operations (platform-op). The system uses system-wide locks to manage operations that cannot be executed in parallel; however, these locks lack fairness in their acquisition logic. Furthermore, when XSM/Flask is enabled, the lock is acquired before permission checks are performed. This allows a less privileged domain or entity to repeatedly acquire or contest the lock, effectively stalling more privileged entities (such as the control domain). This can lead to a host-wide Denial of Service (DoS). The issue is resolved by applying patches provided in XSA-499.
Affected products
- Xen Project Xen 4.0 and later
Timeline
- 2026-07-28: disclosed: Public release of XSA-499
- 2026-07-28: patched: Patches released for Xen 4.17 through 4.21 (unstable)