Xen Security Advisory 504 v2 (CVE-2026-62431) - Viridian STIMER division by zero

--=separator
Content-Type: text/plain; charset="utf-8"
Content-Disposition: inline
Content-Transfer-Encoding: 7bit

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

            Xen Security Advisory CVE-2026-62431 / XSA-504
                               version 2

                   Viridian STIMER division by zero

UPDATES IN VERSION 2
====================

Public release.

ISSUE DESCRIPTION
=================

The logic to handle periodic Viridian STIMERs performs a division with an
unchecked user-controlled divisor value, that can be set to zero to cause a #DE
fault.

IMPACT
======

Enabling Viridian STIMERs to unprivileged HVM guests can result in a Denial
of Service (DoS) affecting the entire host.

VULNERABLE SYSTEMS
==================

All Xen versions from 4.13 onwards are vulnerable.  Xen versions 4.12 and
earlier are not vulnerable.

Only HVM guests with Viridian STIMERs enabled can trigger the vulnerability.

MITIGATION
==========

Not enabling Viridian STIMERs for HVM guests will avoid the vulnerability.

Note Viridian extensions are not enabled by default.

RESOLUTION
==========

Applying the attached patch resolves this issue.

Note that patches for released versions are generally prepared to
apply to the stable branches, and may not apply cleanly to the most
recent release tarball.  Downstreams are encouraged to update to the
tip of the stable branch before applying these patches.

xsa504.patch           xen-unstable - Xen 4.17.x

$ sha256sum xsa504*
cc142e53866a27f3c97bd8532f42df2197f9e8e85fb3846b6fcd682d854e5689  xsa504.patch
$

DEPLOYMENT DURING EMBARGO
=========================

Deployment of the patches above (or others which are substantially similar) is
permitted during the embargo, even on public-facing systems with untrusted
guest users and administrators.

But: Distribution of updated software is prohibited (except to other
members of the predisclosure list).

Predisclosure list members who wish to deploy significantly different
patches and/or mitigations, please contact the Xen Project Security
Team.

(Note: this during-embargo deployment notice is retained in
post-embargo publicly released Xen Project advisories, even though it
is then no longer applicable.  This is to enable the community to have
oversight of the Xen Project Security Team's decisionmaking.)

For more information about permissible uses of embargoed information,
consult the Xen Project community's agreed Security Policy:
  http://www.xenproject.org/security-policy.html
-----BEGIN PGP SIGNATURE-----

iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmpomroMHHBncEB4ZW4u
b3JnAAoJEIP+FMlX6CvZiF4H+QFl08pzXWh5Zd2uOlbjYCaQMoDFeWSGCAkCcG8z
PlKv4yVLPwxUB0W5cPVV61M/fFDgihZh0usNZ/xm5aTt0uhPE31kXItsYRRLPpmg
zbV5OgUgIJxeAABML030lNjlAyLBpVculHAWbyFZdMh/xf0bQc1ty8U/xQDLU+IE
cohmtH8v6WvK2PxTA8nNj39EB9rUcz1gYInLh2QltW14di7+FUHGISxiIr/eNcUv
9d/at8ESSH1WNeSRSr+sbE0dMRxAQgoMa93GvU7sEvuZtdwOnnET8l1nVN/84kXM
sCMq6mjgVDUmSNOH2aBXxewimjp9DV0BLkmliqHrHDKer3s=
=intH
-----END PGP SIGNATURE-----

--=separator
Content-Type: application/octet-stream; name="xsa504.patch"
Content-Disposition: attachment; filename="xsa504.patch"
Content-Transfer-Encoding: base64

RnJvbSBiM2ZlN2JkM2JmNmMyYWM3MzI0ZWEwYjMzY2E2YWZjMzhkODFmMTU5
IE1vbiBTZXAgMTcgMDA6MDA6MDAgMjAwMQpGcm9tOiBSb2dlciBQYXUgTW9u
bmUgPHJvZ2VyLnBhdUBjaXRyaXguY29tPgpEYXRlOiBGcmksIDEwIEp1bCAy
MDI2IDE1OjE4OjEyICswMjAwClN1YmplY3Q6IHg4Ni92aXJpZGlhbjogZW5z
dXJlIGNvdW50IGlzIGFsd2F5cyBzZXQgd2hlbiBzdGFydGluZyBhIHRpbWVy
Ck1JTUUtVmVyc2lvbjogMS4wCkNvbnRlbnQtVHlwZTogdGV4dC9wbGFpbjsg
Y2hhcnNldD1VVEYtOApDb250ZW50LVRyYW5zZmVyLUVuY29kaW5nOiA4Yml0
CgpPdGhlcndpc2UgaW4gcGVyaW9kaWMgbW9kZSBhIGRpdmlzaW9uIGJ5IDAg
d291bGQgaGFwcGVuIG9uIHRoZSBzZWNvbmQgY2FsbAp0byBzdGFydF9zdGlt
ZXIoKSB3aGVuIHVzaW5nIHBlcmlvZGljIG1vZGUuCgpOb3RlIHRoYXQgdGhl
IEh5cGVyViBzcGVjaWZpY2F0aW9uIHN0YXRlczogIldyaXRpbmcgdGhlIHZh
bHVlIHplcm8gdG8gdGhlCkNvdW50IHJlZ2lzdGVyIHdpbGwgc3RvcCB0aGUg
Y291bnRlciwgdGhlcmVieSBkaXNhYmxpbmcgdGhlIHRpbWVyLAppbmRlcGVu
ZGVudCBvZiB0aGUgc2V0dGluZyBvZiBBdXRvRW5hYmxlIGluIHRoZSBjb25m
aWd1cmF0aW9uIHJlZ2lzdGVyLiIKc28gYSB0aW1lciB3aXRoIGEgMCBjb3Vu
dCBzaG91bGQgbmV2ZXIgYmUgaW4gdGhlIGVuYWJsZWQgc3RhdGUuCgpUaGlz
IGlzIFhTQS01MDQgLyBDVkUtMjAyNi02MjQzMS4KCkZpeGVzOiAyNmZiYTNj
ODU1NzEgKCJ2aXJpZGlhbjogYWRkIGltcGxlbWVudGF0aW9uIG9mIHN5bnRo
ZXRpYyB0aW1lcnMiKQpTaWduZWQtb2ZmLWJ5OiBSb2dlciBQYXUgTW9ubsOp
IDxyb2dlci5wYXVAY2l0cml4LmNvbT4KUmV2aWV3ZWQtYnk6IEphbiBCZXVs
aWNoIDxqYmV1bGljaEBzdXNlLmNvbT4KLS0tCiB4ZW4vYXJjaC94ODYvaHZt
L3ZpcmlkaWFuL3RpbWUuYyB8IDEzICsrKysrKysrKysrKy0KIDEgZmlsZSBj
aGFuZ2VkLCAxMiBpbnNlcnRpb25zKCspLCAxIGRlbGV0aW9uKC0pCgpkaWZm
IC0tZ2l0IGEveGVuL2FyY2gveDg2L2h2bS92aXJpZGlhbi90aW1lLmMgYi94
ZW4vYXJjaC94ODYvaHZtL3ZpcmlkaWFuL3RpbWUuYwppbmRleCA5MzExODU4
ZDYzYzAuLjE1ZjYyOWFmMGYzOSAxMDA2NDQKLS0tIGEveGVuL2FyY2gveDg2
L2h2bS92aXJpZGlhbi90aW1lLmMKKysrIGIveGVuL2FyY2gveDg2L2h2bS92
aXJpZGlhbi90aW1lLmMKQEAgLTE1NSw2ICsxNTUsMTQgQEAgc3RhdGljIHZv
aWQgc3RhcnRfc3RpbWVyKHN0cnVjdCB2aXJpZGlhbl9zdGltZXIgKnZzKQog
ICAgICAgICBwcmludGsoWEVOTE9HX0dfSU5GTyAiJXB2OiBWSVJJRElBTiBT
VElNRVIldTogZW5hYmxlZFxuIiwgdiwKICAgICAgICAgICAgICAgIHN0aW1l
cngpOwogCisgICAgaWYgKCAhdnMtPmNvdW50ICkKKyAgICB7CisgICAgICAg
IGdwcmludGsoWEVOTE9HX0VSUiwgIlZJUklESUFOIFNUSU1FUiBzdGFydGVk
IHdpdGggMCBjb3VudFxuIik7CisgICAgICAgIEFTU0VSVF9VTlJFQUNIQUJM
RSgpOworICAgICAgICBkb21haW5fY3Jhc2godi0+ZG9tYWluKTsKKyAgICAg
ICAgcmV0dXJuOworICAgIH0KKwogICAgIGlmICggdnMtPmNvbmZpZy5wZXJp
b2RpYyApCiAgICAgewogICAgICAgICAvKgpAQCAtMzY0LDcgKzM3Miw3IEBA
IGludCB2aXJpZGlhbl90aW1lX3dybXNyKHN0cnVjdCB2Y3B1ICp2LCB1aW50
MzJfdCBpZHgsIHVpbnQ2NF90IHZhbCkKIAogICAgICAgICB2cy0+Y29uZmln
LmFzX3VpbnQ2NCA9IHZhbDsKIAotICAgICAgICBpZiAoICF2cy0+Y29uZmln
LnNpbnR4ICkKKyAgICAgICAgaWYgKCAhdnMtPmNvbmZpZy5zaW50eCB8fCAh
dnMtPmNvdW50ICkKICAgICAgICAgICAgIHZzLT5jb25maWcuZW5hYmxlID0g
MDsKIAogICAgICAgICBpZiAoIHZzLT5jb25maWcuZW5hYmxlICkKQEAgLTU3
NSw2ICs1ODMsOSBAQCB2b2lkIHZpcmlkaWFuX3RpbWVfbG9hZF92Y3B1X2N0
eHQoCiAKICAgICAgICAgdnMtPmNvbmZpZy5hc191aW50NjQgPSBjdHh0LT5z
dGltZXJfY29uZmlnX21zcltpXTsKICAgICAgICAgdnMtPmNvdW50ID0gY3R4
dC0+c3RpbWVyX2NvdW50X21zcltpXTsKKyAgICAgICAgaWYgKCAhdnMtPmNv
bmZpZy5zaW50eCB8fCAhdnMtPmNvdW50ICkKKyAgICAgICAgICAgIC8qIFJl
amVjdCBlbmFibGluZyB3aXRoIGEgemVybyBzaW50eCBvciBjb3VudCBmaWVs
ZHMuICovCisgICAgICAgICAgICB2cy0+Y29uZmlnLmVuYWJsZSA9IDA7CiAg
ICAgfQogfQogCi0tIAoyLjUzLjAKCg==

--=separator--