Xen Security Advisory 503 v2 (CVE-2026-62430) - x86: Out-of-bounds read in vRTC emulation
Xen.org security team <[email protected]>
| Newsgroups | org.xenproject.lists.xen-devel |
|---|---|
| Message-ID | <[email protected]> |
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Xen Security Advisory CVE-2026-62430 / XSA-503
version 2
x86: Out-of-bounds read in vRTC emulation
UPDATES IN VERSION 2
====================
Public release.
ISSUE DESCRIPTION
=================
Accesses to the CMOS memory contents are done using an indirect IO port
pair. Therefore Xen needs to cache the guest chosen index, and one of
the usages of the index didn't take the necessary locking to avoid
concurrent changes. As a result, a guest could change the index after
it being checked, causing a subsequent out-of-bound read access to the
contents of an array.
IMPACT
======
An attacker can read out-of-bounds, this is limited to Xen data, and not
data belonging to other guests.
VULNERABLE SYSTEMS
==================
All Xen versions from 3.2 onwards are vulnerable. Xen versions 3.1 and
earlier are not vulnerable.
MITIGATION
==========
Running only PV or PVH guests will avoid the vulnerability.
RESOLUTION
==========
Applying the appropriate attached patch resolves this issue.
Note that patches for released versions are generally prepared to
apply to the stable branches, and may not apply cleanly to the most
recent release tarball. Downstreams are encouraged to update to the
tip of the stable branch before applying these patches.
xsa503.patch xen-unstable - Xen 4.19.x
xsa503-4.18.patch Xen 4.18.x - Xen 4.17.x
$ sha256sum xsa503*
86ffb287767aa410e2c6b970db5167d743ca3c788b43522d46d06f41caead929 xsa503.patch
3a09ea83f092ade72c8d107c91b480f44e5c865d7f36306db8490403db9aa7ed xsa503-4.18.patch
$
DEPLOYMENT DURING EMBARGO
=========================
Deployment of the patches and/or mitigations described above (or
others which are substantially similar) is permitted during the
embargo, even on public-facing systems with untrusted guest users and
administrators.
But: Distribution of updated software is prohibited (except to other
members of the predisclosure list).
Predisclosure list members who wish to deploy significantly different
patches and/or mitigations, please contact the Xen Project Security
Team.
(Note: this during-embargo deployment notice is retained in
post-embargo publicly released Xen Project advisories, even though it
is then no longer applicable. This is to enable the community to have
oversight of the Xen Project Security Team's decisionmaking.)
For more information about permissible uses of embargoed information,
consult the Xen Project community's agreed Security Policy:
http://www.xenproject.org/security-policy.html
-----BEGIN PGP SIGNATURE-----
iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmpomrgMHHBncEB4ZW4u
b3JnAAoJEIP+FMlX6CvZMg8H/0FuxuDZLnfvFfa8uGtWBokPW93kxSjCoPG3obbR
pJ4IqULRNrdMQfo+3ssrppoH41/ADzatAkbB6seW7UWhVmXCFBE19ZELGXtkn1bh
GU68jjUq4u4BgQSIXsapcN2wNPahVOnD8+N5dayb+/zde8aBST10xhT3tmvNnR5k
dI4t1W3LOXqO4QPXKua7ipLGzTnnzkgHflssYbyclmL2qq82frDUCl5Kf8EDkzhC
I2YigSVjYsreQHIYUpeGADB7/Xpr/ARnqaWi2cB9O3FhlkvJDIWOAR3fUuIfZnim
ASzMZSPwRQ8Mo2TuzSSXjG2oIVkZy8+6thia9cZLuP18UzY=
=UuFk
-----END PGP SIGNATURE-----
xsa503.patch
(application/octet-stream, 1.9 KB)
From 92885076ed6ea3a652b0143ce112582f91932b13 Mon Sep 17 00:00:00 2001 From: Roger Pau Monne <[email protected]> Date: Fri, 10 Jul 2026 15:05:50 +0200 Subject: x86/vrtc: fix race in CMOS index checking MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Do the checking for a valid CMOS index while holding the spinlock, otherwise the value could be changed by the guest after having been checked. This is XSA-503 / CVE-2026-62430. Fixes: 34bef0e6d5f4 ("hvm: Add locking to platform timers.") Signed-off-by: Roger Pau Monné <[email protected]> Reviewed-by: Jan Beulich <[email protected]> --- xen/arch/x86/hvm/rtc.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/xen/arch/x86/hvm/rtc.c b/xen/arch/x86/hvm/rtc.c index 4ba5881b24de..65b3b79f1edb 100644 --- a/xen/arch/x86/hvm/rtc.c +++ b/xen/arch/x86/hvm/rtc.c @@ -647,13 +647,21 @@ static int update_in_progress(RTCState *s) return 0; } -static uint32_t rtc_ioport_read(RTCState *s) +static bool rtc_ioport_read(RTCState *s, uint32_t *val) { int ret; struct domain *d = vrtc_domain(s); + *val = ~0; + spin_lock(&s->lock); + if ( s->hw.cmos_index >= RTC_CMOS_SIZE ) + { + spin_unlock(&s->lock); + return false; + } + switch ( s->hw.cmos_index ) { case RTC_SECONDS: @@ -693,7 +701,9 @@ static uint32_t rtc_ioport_read(RTCState *s) spin_unlock(&s->lock); - return ret; + *val = ret; + + return true; } static int cf_check handle_rtc_io( @@ -718,11 +728,8 @@ static int cf_check handle_rtc_io( *val = 0xff; return X86EMUL_OKAY; } - else if ( vrtc->hw.cmos_index < RTC_CMOS_SIZE ) - { - *val = rtc_ioport_read(vrtc); + else if ( rtc_ioport_read(vrtc, val) ) return X86EMUL_OKAY; - } return X86EMUL_UNHANDLEABLE; } -- 2.53.0
xsa503-4.18.patch
(application/octet-stream, 2 KB)
From 26452e289eb6f64e85d630c06a9f3de7d0188cd7 Mon Sep 17 00:00:00 2001 From: Roger Pau Monne <[email protected]> Date: Wed, 15 Jul 2026 12:44:37 +0200 Subject: x86/vrtc: fix race in CMOS index checking MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Do the checking for a valid CMOS index while holding the spinlock, otherwise the value could be changed by the guest after having been checked. This is XSA-503 / CVE-2026-62430. Fixes: 34bef0e6d5f4 ("hvm: Add locking to platform timers.") Signed-off-by: Roger Pau Monné <[email protected]> Reviewed-by: Jan Beulich <[email protected]> --- xen/arch/x86/hvm/rtc.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/xen/arch/x86/hvm/rtc.c b/xen/arch/x86/hvm/rtc.c index 483937435205..ad15825a1f20 100644 --- a/xen/arch/x86/hvm/rtc.c +++ b/xen/arch/x86/hvm/rtc.c @@ -647,16 +647,24 @@ static int update_in_progress(RTCState *s) return 0; } -static uint32_t rtc_ioport_read(RTCState *s, uint32_t addr) +static bool rtc_ioport_read(RTCState *s, uint32_t addr, uint32_t *val) { int ret; struct domain *d = vrtc_domain(s); + *val = ~0; + if ( (addr & 1) == 0 ) - return 0xff; + return true; spin_lock(&s->lock); + if ( s->hw.cmos_index >= RTC_CMOS_SIZE ) + { + spin_unlock(&s->lock); + return false; + } + switch ( s->hw.cmos_index ) { case RTC_SECONDS: @@ -696,7 +704,9 @@ static uint32_t rtc_ioport_read(RTCState *s, uint32_t addr) spin_unlock(&s->lock); - return ret; + *val = ret; + + return true; } static int cf_check handle_rtc_io( @@ -716,11 +726,8 @@ static int cf_check handle_rtc_io( if ( rtc_ioport_write(vrtc, port, (uint8_t)*val) ) return X86EMUL_OKAY; } - else if ( vrtc->hw.cmos_index < RTC_CMOS_SIZE ) - { - *val = rtc_ioport_read(vrtc, port); + else if ( rtc_ioport_read(vrtc, port, val) ) return X86EMUL_OKAY; - } return X86EMUL_UNHANDLEABLE; } -- 2.53.0