Xen漏洞公告(XSA-499)：CVE-2026-62426/427 锁公平性及权限检查时序缺陷导致DoS

漏洞概述 漏洞编号: CVE-2026-62426, CVE-2026-62427 标题: sysctl 和 platform 锁开放滥用 描述: 在 Xen 系统中，sysctl 和 platform 操作被用于控制域或可能的 Xenstore 域。某些操作不应并行执行，因此使用系统级锁。然而，这些锁的获取方式缺乏公平性，并且在使用 XSM/FW 时，锁的获取发生在权限检查之前。这可能导致低权限实体通过高权限实体导致拒绝服务（DoS）。 影响范围 受影响系统: 所有 Xen 4.0 及以上版本均存在此漏洞。早期版本使用不同的锁定操作，但也可能受到影响。 修复方案 补丁: 提供了多个补丁文件，适用于不同版本的 Xen（从 4.17 到 4.21）。 部署建议: 补丁已针对稳定分支发布，下游发行版应尽快更新到稳定分支。 注意事项: 补丁包含对默认 Flask 策略的调整，启用核心策略时需要重新构建。 代码块 ```plaintext -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Xen Security Advisory CVE-2026-62426,CVE-2026-62427 / XSA-499 version 2 sysctl and platform-ops locks open to abuse UPDATES IN VERSION 2 Add further tags to patches. Public release. ISSUE DESCRIPTION To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these operations may not be executed in parallel, so a system-wide lock each is used. The way those locks are acquired is, however, not providing any fairness. Furthermore, with XSM/FW in use, the lock acquire will, for some operations, occur ahead of any permission checking. The sysctl issue is CVE-2026-62426. The platform-ops issue is CVE-2026-62427. IMPACT A less privileged entity may stall an equally or more privileged entity, potentially leading to a Denial of Service (DoS) of up to the entire host. VULNERABLE SYSTEMS All Xen versions from 4.0 onwards are vulnerable. Earlier versions use a different locking operation, but may also be vulnerable. MITIGATION There is no known mitigation. CREDITS This issue was discovered by Jan Beulich of SUSE. RESOLUTION Applying the appropriate set of attached patches resolves this issue. NOTE: The patches include an adjustment to the default Flask policy. When core policies are in use, a respective change will need making there. Note that patches for released versions are generally prepared to apply to the stable branches, and may not apply cleanly to the most recent release tarball. Downstreams are encouraged to update to the tip of the stable branch before applying these patches. xsax99/xsax99-7.patch xen-unstable - Xen 4.21.x xsax99/xsax99-4.20-7.patch Xen 4.20.x - Xen 4.19.x xsax99/xsax99-4.18-7.patch Xen 4.18.x xsax99/xsax99-4.17-7.patch Xen 4.17.x $ sha256sum xsax99/* 16716146d7106b970717bc4801a5491116d0ff6e7fd428996bfb9fd1d747 xsax99/xsax99-1.patch 80692a9a361a407a7e7c9c104a453847295471fd13d0713c049b7fe xsax99/xsax99-2.patch XSA499-2026072010a5996463773b03323b3e7f6b2a886d1461ca xsax99/xsax99-3.17-1.patch 3f8346602a3e4ec6cf40a800284464243441df4f14b6b5777f3420f816 xsax99/xsax99-4.17-2.patch XSA499-2026072010a5996463773b03323b3e7f6b2a886d1461ca xsax99/xsax99-4.17-3.patch 3f8346602a3e4ec6cf40a800284464243441df4f14b6b5777f3420f816 xsax99/xsax99-4.17-4.patch XSA499-2026072010a5996463773b03323b3e7f6b2a886d1461ca xsax99/xsax99-4.17-5.patch 3f8346602a3e4ec6cf40a800284464243441df4f14b6b5777f3420f816 xsax99/xsax99-4.17-6.patch XSA499-2026072010a5996463773b03323b3e7f6b2a886d1461ca xsax99/xsax99-4.17-7.patch d516d678a756f08a48d42a1c4a8b621be4ca108410848e8d8c107f8b33f2 xsax99/xsax99-4.18-1.patch 77287c6a6df768b0a2b041a448b81503100b6c4d333754c27 xsax99/xsax99-4.18-2.patch 8c288089991460df1fc1d265e08837935ab8d5696154699a3b4966c4e xsax99/xsax99-4.18-3.patch XSA499-2026072010a5996463773b03323b3e7f6b2a886d1461ca xsax99/xsax99-4.18-4.patch 9551c14ec178b951e07f3b6f86e73ac4d0d566d45d43a31d092b3b7 xsax99/xsax99-4.18-5.patch XSA499-2026072010a5996463773b03323b3e7f6b2a886d1461ca xsax99/xsax99-4.18-6.patch 48d896655368199b6ab6199b1209ae78ec2d415735a57106cf7e7785 xsax99/xsax99-4.18-7.patch XSA499-2026072010a5996463773b03323b3e7f6b2a886d1461ca xsax99/xsax99-4.20-1.patch 9423118414645017121b28775f73c495646b6454f6678b8b57e78c19b8b xsax99/xsax99-4.20-2.patch XSA499-2026072010a5996463773b03323b3e7f6b2a886d1461ca xsax99/xsax99-4.20-3.patch 892a1488b1400b048b12d4a9562056a5d52547f40418b84b4c61c65be xsax99/xsax99-4.20-4.patch XSA499-2026072010a5996463773b03323b3e7f6b2a886d1461ca xsax99/xsax99-4.20-5.patch 66646313292d477ca00214d427b5a2cf18b5c602f427140010928ac xsax99/xsax99-4.20-6.patch XSA499-2026072010a5996463773b03323b3e7f6b2a886d1461ca xsax99/xsax99-4.20-7.patch XSA499-2026072010a5996463773b03323b3e7f6b2a886d1461ca xsax99/xsax99-5.patch d91737487c45b931609256de3d27c8e8f4d41a484748cc418b19b8b xsax99/xsax99-6.patch 96131dc75a26b62d57d243dc725c8c4509c4156d88dc47faac03752 xsax99/xsax99-7.patch 603b334beeef7f8b3a0b1d6cf72bc8d21c4129e975b77ac4c4b563 xsax99/xsax99-7.patch -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEE1ML8RrFHXGcPng/dUyYfk0k9kFamponodPRM8m0nEB4Z2k4u 33NkA0IEEPJNM1X6CXZ94XU/3X075T1wme8d80nXwvyx5f1U2ze14F57K00m p0b0Z0WQm1frcyup20h1B0Mxan20WY1JAc9p8d80f819e-qpu8eT82JHP9Jb 66c04Xb0d2e2d5a7e9b11a1dMmN1Yf4a1e5XCY5f1SbVq4vXq0bN8kN1 f6cp5M8d4Xw4c1vXk0b218q8-ma8d4v1q8u1j9b1d81j6b1d81j6b1d81j6b1d81j6b1d81j6b1d81j6b1d81j6b1d81j6b1d81j6b1d81j6b1d81j6b1d81j6b1d81j6b1d81j6b1d81j6b1d81j6b1d81j6b1d81j6b1d81j6b1d81j6b1d81j6b1d81j6b1d81j6b1d81j6b1d81j6b1d81j6b1d81j6b1d81j6b1d81j6b1d81j6b1d81j6b1d81j6b1d81j6b1d81j6b1d81j6b1d

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

Xen漏洞公告(XSA-499)：CVE-2026-62426/427 锁公平性及权限检查时序缺陷导致DoS

目标达成感谢每一位支持者 — 我们达成了 100% 目标！