Xen hypervisor flaws let one VM read and write any other VM memory
Original title: Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory
Xen versions 4.6+ allow a malicious guest VM to read and write memory of other VMs including dom0 via grant copy permission checks.
Two flaws in the Xen hypervisor permit a malicious guest virtual machine to read and write memory of any other VM on the same host, including dom0. Patches are available for affected versions. No known exploitation or public attacks.
- Tracked as CVE-2026-102703 and CVE-2026-102704
- Affects Xen from 4.6 to 4.19
- Found using Anthropic Claude model
- No mitigation other than patching
Impact: read and write access to memory of other VMs including dom0
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-102703+1 related CVE | Frame/grant ref mixing in Xen grant copy cache | 4.4 | — |
From the original article
2 min read at thehackernews.com
Two flaws in the Xen hypervisor allow a malicious guest virtual machine (VM) to read and write the memory of other VMs on the same host, including dom0. Dom0 is the VM that, by default, has full permissions and manages the others. Patches are out, and there is no known mitigation, the Xen Project said in an advisory on November 3.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.