Xen hypervisor flaws let one VM read and write any other VM memory
Xen versions 4.6+ allow a malicious guest VM to read and write memory of other VMs including dom0 via grant copy permission checks.
75
CVE-2026-102704
Misplaced permission check in Xen grant copy by frame number
- CVSS 3.1
- 4.4 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Xen's grant copy operations did not correctly enforce the restriction that copying by frame number is permitted only on the caller's own memory. An attacker can trigger the flaw by issuing grant copy calls using frame numbers on non-owned memory. This allows arbitrary read/write. Xen users are affected.
What to do: Apply Xen Security Advisory 523 v2 for CVE-2026-102704
| Product | Affected |
|---|---|
| Xen | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] A common access pattern is a batch of Grant Copy operations acting on adjacent address ranges in the same source or destination page. For performance reasons, Xen caches details internally to reuse already validated data. The conditions on when to re-validate the internal data were not correct in some cases: - Frame numbers and grant references could wrongly be mixed up. This is CVE-2026-102703. - Copying by frame number (rather than grant reference) is permitted only when operating on the caller's own memory. The check to enforce this restriction was misplaced. This is CVE-2026-102704.
- Weakness
- CWE-693
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
In the news
2 storiesXen XSA-523 v2 discloses arbitrary read/write via grant copy
Public release of XSA-523 v2 details batch grant copy optimizations and potential read/write issues in Xen.
70