漏洞概述 漏洞名称: x86 HVM I/O port list traversal CVE编号: CVE-2026-42487 发布日期: 2026-06-09 12:00 更新版本: 2 描述: HVM guest I/O port访问可能受到模拟或实时翻译的影响。翻译由设备模型（通过XEN_DOMCTL_ioport_mapping）管理，因此链接列表可能随时更改。在处理guest I/O端口访问时，遍历这些列表需要同步更新，但缺少同步机制。 影响范围 受影响系统: 所有从3.2版本开始的Xen版本均受影响。早期版本未被检查。 受影响架构: 仅x86系统受影响，Arm系统不受影响。 潜在影响: 设备模型运行的stub域或de-privileged域中的实体可以利用此漏洞，导致整个主机的拒绝服务（DoS）。特权升级和信息泄露也不能排除。 修复方案 缓解措施: 运行任何PV或HVM guest将避免此漏洞。 补丁应用: 应用适当的补丁可解决此问题。补丁适用于稳定分支，可能不直接适用于最新发布的tarball。下游用户应在应用补丁前更新到稳定分支的顶部。 补丁文件: - - - (Xen 4.21.x - Xen 4.17.x) POC代码/利用代码 页面中未包含具体的POC代码或利用代码。 其他信息 发现者: Jan Beulich of SUSE 部署期间: 在 embargo 期间，允许部署补丁和/或缓解措施，但禁止向未列入预披露列表的成员分发更新软件。 更多信息: 可访问 Xen Project Security Policy 获取更多信息。 --- ```plaintext -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Xen Security Advisory CVE-2026-42487 / XSA-491 version 2 x86 HVM I/O port list traversal UPDATES IN VERSION 2 ==================== Public release. ISSUE DESCRIPTION ================= HVM guest I/O port accesses are subject to either emulation or at least translation. Translations are managed by the device model (via XEN_DOMCTL_ioport_mapping), and hence the linked list used may change at any time. Traversal of those lists (while handling guest I/O port accesses) therefore needs synchronizing with updates, which was missing so far. IMPACT ====== A device model of a HVM guest can cause a hypervisor crash, causing a Denial of Service (DoS) of the entire host. Privilege escalation and information leaks cannot be ruled out. VULNERABLE SYSTEMS ================== All Xen versions from at least 3.2 onwards are vulnerable. Earlier versions have not been inspected. Only x86 systems are vulnerable. Arm systems are not vulnerable. Only entities controlling HVM guests can leverage the vulnerability. These are device models running in either a stub domain or de-privileged in Dom0. MITIGATION ========== Running only PV or HVM guests will avoid the vulnerability. (Switching from a device model stub domain or a de-privileged device model to a fully privileged Dom0 device model does NOT mitigate this vulnerability. Rather, it simply re-categorises the vulnerability to hostile management code, regarding it "as designed". It merely reclassifies these issues as "not a bug". The security of a Xen system using stub domains is still better than with a qemu-dm running as a Dom0 process. Users and vendors of stub qemu dm systems should not change their configuration to use a Dom0 qemu process.) CREDITS ======= This issue was discovered by Jan Beulich of SUSE. RESOLUTION ========== Applying the appropriate attached patch resolves this issue. Note that patches for released versions are generally prepared to apply to the stable branches, and may not apply cleanly to the most recent release tarball. Downstreams are encouraged to update to the tip of the stable branch before applying these patches. xsax91.patch Xen-unstable xsax91-4.21.patch Xen 4.21.x - Xen 4.17.x $ sha256sum xsax91* 23a9664c17130993331846169f565ae71b44f5f4bbd30b18fcbf8ad775b3f8 xsax91.patch 443674f24269293536b8ad91fa1bfbbe0877fcf3a39ae53368e49e933aa xsax91-4.21.patch DEPLOYMENT DURING EMBARGO ========================= Deployment of the patches and/or mitigations described above for others which are substantially similar) is permitted during the embargo, even on public-facing systems with untrusted guest users and administrators. But: Distribution of updated software is prohibited (except to other members of the pre-disclosure list). Pre-disclosure list members who wish to deploy significantly different patches and/or mitigations, please contact the Xen Project Security Team. (Note: this during-embargo deployment notice is retained in post-embargo publicly released Xen Project advisories, even though it is then no longer applicable. This is to enable the community to have oversight of the Xen Project Security Team's decision-making.) For more information about permissible uses of embargoed information, consult the Xen Project community's agreed Security Policy: http://www.xenproject.org/security-policy.html -----BEGIN PGP SIGNATURE----- iQJBAFBECgAFEET1WLLBRF9HX6GZCny/4y1ofK9X4anm49M8HmEB4Z2Wu b3Jxa4aEjP+PHKMCZDqMIA3p9v2qyM9VPLRC1sotur8x1c9w6d8971a5 gao3XO0+8kjrRSPc0v/cNv1Aa1PK75V4N4sSMK1Q9eJ0R3x161Z0T1p 2Z08p2J36x0q019X14M8Dv1e1r1A1Z0p7M01j1ChbXc0M4XwXyXcXf6 SpE11k11M9M9P7P4A1S1N1E1M1J1R1p1d1g1x1p1X1Q1U1T1h1m1G1L1h1 M1w1J1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c 1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c 1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c 1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c 1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c 1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c 1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c 1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c 1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c 1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c1X1c 1X1c1X1c1X1c1X1c1X