Xen XSA-516/XSS-2026-003: XPTI在大内存系统上的权限提升漏洞

漏洞概述 漏洞名称: XSA-516 CVE编号: CVE-2026-79609 发布日期: 2026-10-13 12:00 更新日期: 2026-10-13 12:28 版本: 2 标题: x86: XPTI may break on huge-memory systems 影响范围 受影响系统: 所有带有XPTI工作后向移植的Xen版本，包括上游的Xen 4.7.5及以后版本、Xen 4.8.3及以后版本、Xen 4.9.2及以后版本、Xen 4.10.1及以后版本，以及所有4.11及以后的主要版本。 具体影响: - 64位PV客户机可能提升其权限到主机级别。 - 可能观察到其他客户机的信息或导致整个主机的拒绝服务（DoS）。 - 仅当系统内存超过5 TiB（CONFIG_BIGMEM > 3.5 TiB）时受影响。 - 32位PV客户机、HVM和PVH客户机不受影响。 - x86系统受影响，Arm系统不受影响。 修复方案 补丁文件: - - - - 补丁应用: - 补丁适用于稳定分支，可能需要更新到稳定分支的顶部再应用。 - 补丁哈希值： 临时缓解措施: - 使用 hypervisor命令行选项限制Xen使用的内存量，例如 用于CONFIG_BIGMEM=n情况， 用于CONFIG_BIGMEM=y情况。 其他信息 发现者: George Dunlap 部署期间限制: - 在预披露期间，禁止分发更新软件（除预披露列表成员外）。 - 预披露列表成员如需部署不同补丁或缓解措施，请联系Xen项目安全团队。 更多信息: 可访问Xen项目社区的安全决策页面获取更多信息。 代码块 ```plaintext -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Xen Security Advisory CVE-2026-79609 / XSA-516 version 2 x86: XPTI may break on huge-memory systems UPDATES IN VERSION 2 Public release ISSUE DESCRIPTION XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown (CVE-2017-5754, one aspect of XSA-254). This involves copying 64-bit pv guest page table entries from guest-chosen root page tables to the Xen- chosen one which is in actual use by hardware. To read the guest root page table, the directory is used. PV guests, however, have a directory that may not cover all memory, in particular this is the case if any memory extends beyond the 5 TiB (CONFIG_BIGMEM > 3.5 TiB) address boundary. IMPACT A 64-bit PV guest may be able to elevate its privilege to that of the host. It is also possible for them to observe information pertaining to other guests, or to cause Denial of Service (DoS) affecting the entire host. VULNERABLE SYSTEMS All versions of Xen with the XPTI work backported to are affected. In upstream these are Xen 4.7.5 and onwards, Xen 4.8.3 and onwards, Xen 4.9.2 and onwards, Xen 4.10.1 and onwards, and all major releases from 4.11 onwards. Only 64-bit PV guests can leverage the vulnerability. HVM and PVH guests cannot leverage the vulnerability. 32-bit PV guests haven't been security supported anymore. Only x86 systems are affected. Arm systems are not affected. Only systems with RAM above the 5 TiB (CONFIG_BIGMEM > 3.5 TiB) boundary are affected. Systems with no RAM above the 5 TiB (CONFIG_BIGMEM > 3.5 TiB) boundary are not affected. MITIGATION Not running 64-bit PV guests will avoid the vulnerability. The "mem=" hypervisor command line option may be used to limit the amount of memory Xen is going to use. That would be "mem=5T" for the CONFIG_BIGMEM=n case and "mem=5584G" for the CONFIG_BIGMEM=y one. CREDITS This issue was discovered by George Dunlap. RESOLUTION Applying the appropriate attached patch resolves this issue. Note that patches for released versions are generally prepared to apply to the stable branches, and may not apply cleanly to the most recent release tarball. Downstreams are encouraged to update to the tip of the stable branch before applying these patches. xsa516.patch xen-unstable - Xen 4.19.x xsa516-4.16.patch Xen 4.16.x xsa516-4.17.patch Xen 4.17.x $ sha256sum xsa516* af5f59350e37a12b762775820a25682987ccaffff78d5663653552eca88 xsa516.patch 06818ca564ff7ccc1f4842e9977a4eeec283c1695988e65-1pfd4d1d4dbdb0 xsa516-4.17.patch 099871716a99508e5721884a150e4b878ae0795d95988e65-1pfd4d1d4dbdb0 xsa516-4.18.patch DEPLOYMENT DURING EMBARGO Deployment of the patches and/or mitigations described above (or others which are substantially similar) is permitted during the embargo, even on public-facing systems with untrusted guest users and administrators. But: Distribution of updated software (except to other members of the pre-disclosure list) is prohibited. Pre-disclosure list members who wish to deploy significantly different patches and/or mitigations, please contact the Xen Project Security Team. (Note: this during-embargo deployment notice is retained in post-embargo publicly released Xen Project advisories, even though it is then no longer applicable. This is to enable the community to have oversight of the Xen Project Security Team's decisionmaking.) For more information about permissible uses of embargoed information, consult the Xen Project community's agreed Security Policy: http://www.xenproject.org/security/embargo.html -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFIEEi+MILBRFRXK6Gcng/4IyVfok9KFAm01JwM9mRnCEB4Z4u b3J3AcJEIPPMX6CZ0L0h/Ap14Nn0u1HAPGdWqpb/N8g3eJpVx/SX5x128gb +1aL1cV121612121MCHB/FPLDNYK63nhaar/7cP01b3c241yem2lTfQg4a5723U1 Hl4MPCkmpcXpM8s5b1peep5XT5YH1i+GmDb211Xhno11254uVV2P2X50M3 asx1B4e3V4x4yRbqbd141260W9jA4zG3T1Gd21067c2yM9Wv4x41260W9j5 3e1XK0d3b24F1e5xzc007o1RLJxX0r4KX5bwy5x2X10r20hbn/PuTy8p/PG sL0XMDNha1x1d1Q20hHb0d8bxc775c1JwM9mRn01JwM9mRn01JwM9mRn01JwM9mRn01JwM9mRn01JwM9mRn01JwM9mRn01JwM9mRn01JwM9mRn01JwM9mRn01JwM9mRn01JwM9mRn01JwM9mRn01JwM9mRn01JwM9mRn01JwM9mRn01JwM9mRn01JwM9mRn01JwM9mRn01JwM9mRn01JwM9mRn01JwM9mRn01JwM9mRn01JwM9mRn01JwM9mRn01JwM9mRn01JwM9mRn01JwM9mRn01JwM9mRn01JwM9mRn01JwM9mRn01JwM9mRn01JwM9mRn01JwM9mRn01JwM9mRn01JwM9mRn01JwM9mRn01JwM9mRn01JwM9mR

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

Xen XSA-516/XSS-2026-003: XPTI在大内存系统上的权限提升漏洞

目标达成感谢每一位支持者 — 我们达成了 100% 目标！