Citrix XenServer Vulnerabilities Could Allow Malicious VM Users to Compromise Host Systems
Citrix disclosed four XenServer flaws that may let privileged guest users compromise or crash the host.
62
Vulnerability2 · 1 read
CVE-2026-79611
Xen VMX guest crash in debug single-step with branch tracing
- CVSS 3.1
- 5.5 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-79611 is a flaw in logic the Xen hypervisor added for XSA-308, which was meant to let Intel VMX accept a legitimate guest state where a debug exception (#DB) is intercepted, single-stepping is active, and the guest is blocked by STI or MOVSS. A missed sub-case remains: with branch tracing also enabled, that earlier adjustment still fails the processor's VMEntry checks. The failed VMEntry is fatal to the guest, so the guest crashes; the CVE text does not describe host compromise or data theft. Intel VT-x/VMX systems running the affected Xen code are in scope, including Xen-based products such as Citrix XenServer or Citrix Hypervisor where that logic is shipped, but exact versions are not in the supplied data. No public proof of concept is known and the issue is not in CISA KEV.
What to do: Apply the Xen Project update that corrects the XSA-308 VMX branch-tracing case, and the matching Citrix XenServer or Citrix Hypervisor hotfix once the vendor maps it to CVE-2026-79611. Until then, limit guest use of single-step and branch-trace debugging and investigate unexpected guest crashes during those operations. No fixed version numbers are given in the supplied data, so use the vendor advisories rather than guessing a release.
| Product | Affected |
|---|---|
| Xen Project Xen hypervisor | — |
| Citrix XenServer / Citrix Hypervisor | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
For XSA-308 logic was introduced, as VMX VMEntry checks do not like the exact combination of state which occurs when #DB in intercepted, Single Stepping is active, and blocked by STI/MovSS is active, despite this being a legitimate state to be in. The resulting VMEntry failure is fatal to the guest. Sadly there is another special sub-case of the above, with branch tracing enabled. In that case the prior adjustment would still cause a VMentry failure, as before fatal to the guest.
- Weakness
- CWE-843
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
In the news
2 storiesCitrix Patches XenServer Vulnerabilities That Could Enable Host Compromise
Citrix patched four XenServer flaws, three of which could let a privileged guest compromise or crash the host.
62