Xen Hypervisor Security Advisory Vulnerabilities

Denial of service against Xen host management is possible through deliberate abuse of the unfair domctl system-wide lock, affecting all Xen versions from 3.3 onwards. A less-privileged domain can monopolize the lock used to serialize guest creation and management operations, starving the control domain or equally/more-privileged entities of lock access and potentially rendering the entire host unmanageable. No public exploit identified at time of analysis, and no CVSS score was published with XSA-492.

Xen Hypervisor's domctl locking mechanism, when XSM/Flask mandatory access control is enabled, acquires the system-wide serialization lock for certain operations before performing any Flask permission checks. This allows a less-privileged guest domain to seize the lock without authorization and stall equally or more privileged entities - including the control domain (dom0) and Xenstore domain - potentially causing a Denial of Service affecting the entire physical host. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.

Unsynchronized traversal of HVM I/O port translation linked lists in the Xen hypervisor on x86 systems exposes a race condition exploitable by a compromised or malicious device model. The hypervisor manages I/O port translations via a linked list modified by the device model through XEN_DOMCTL_ioport_mapping; because traversal of that list during I/O port handling was never synchronized against concurrent modifications, a racing update can corrupt traversal state. The resulting hypervisor crash causes a Denial of Service of the entire host, with privilege escalation and information leakage explicitly acknowledged as non-ruled-out consequences - all without any active CISA KEV listing or public exploit identified at time of analysis.

Shadow paging error paths in Xen Hypervisor 4.15+ on x86 allow 64-bit PV guests operating in shadow mode to corrupt mapcache metadata by triggering a page-table switch that does not update the currently running vCPU reference. Successful exploitation by a guest can result in privilege escalation into the hypervisor, host-wide denial of service, and information leaks affecting all co-resident guests. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available for all supported stable branches.