New security update candidates for you to test!

olivierlambert

OK keep us posted. Which Alma version exactly? (so we can try to reproduce)

gduperrey

New security update candidates for you to test!

A new XSA (Xen Security Advisory) was published on the 9th of September, and an update to Xen addresses it.

xen-*:
- Fix XSA-472 — Potential risks include Denial of Service (DoS) impacting the whole host, information exposure, or escalation of privileges. There are several vulnerabilities associated with the way guest memory pages are handled and accessed in the Viridian code:
  - NULL pointer dereference during reference TSC area update — This issue occurs when the system tries to update the reference TSC area but encounters a NULL pointer. (CVE-2025-27466)
  - NULL pointer dereference when delivering synthetic timer messages — This happens if the code assumes the SIM page is already mapped when a synthetic timer message must be delivered. (CVE-2025-58142)
  - Race condition in reference TSC page mapping — A guest system can trigger Xen to release a memory page while it is still referenced in the guest’s physical-to-machine (p2m) page tables. (CVE-2025-58143)

Test on XCP-ng 8.2

yum clean metadata --enablerepo=xcp-ng-candidates
yum update --enablerepo=xcp-ng-candidates
reboot

The usual update rules apply: pool coordinator first, etc.

Versions:

xen: 4.13.5-9.49.4.xcpng8.2

What to test

Normal use and anything else you want to test.

Test window before official release of the updates

~2 days.

Remarks

Another XSA (474) was released the same day regarding XAPI. Since the attack vector differs and is not easily exploitable in 8.2, we have not released a patch for it, unlike in 8.3.

As a reminder, XCP-ng 8.2 LTS will no longer be supported as of September 16, 2025.

We therefore strongly encourage you to migrate your pools to XCP-ng 8.3 LTS to continue benefiting from the latest security fixes and improvements.

gduperrey

New security update candidates for you to test!

News XSAs (Xen Security Advisory) were published on the 9th of September, and updates to Xen & XAPI address them.

xapi:
- Fix XSA-474 — A Denial of Service can be caused by buggy or malicious inputs to XAPI (CVE-2025-58146). There are several vulnerabilities identified in XAPI:
  - Input sanitisation mismatch in notifications — While updates to the XAPI database correctly sanitise input strings, the system generates notifications using the unsanitised version. This flaw causes the database’s event thread to crash, halting further processing.
  - Inconsistent UTF-8 handling — XAPI’s UTF-8 encoder follows version 3.0 of the Unicode specification, whereas some of the libraries it relies on enforce the stricter version 3.1 standard. As a result, certain strings may be accepted as valid UTF-8 by XAPI but rejected by other components. If such strings are entered into the database, the database can subsequently fail to load.
  - Lack of sanitisation in Map/Set updates — When updating Map/Set objects in the XAPI database, no sanitisation is applied to the inputs, which introduces additional risks.
xen-*:
- Fix XSA-472 — Potential risks include Denial of Service (DoS) impacting the whole host, information exposure, or escalation of privileges. There are several vulnerabilities associated with the way guest memory pages are handled and accessed in the Viridian code:
  - NULL pointer dereference during reference TSC area update — This issue occurs when the system tries to update the reference TSC area but encounters a NULL pointer. (CVE-2025-27466)
  - NULL pointer dereference when delivering synthetic timer messages — This happens if the code assumes the SIM page is already mapped when a synthetic timer message must be delivered. (CVE-2025-58142)
  - Race condition in reference TSC page mapping — A guest system can trigger Xen to release a memory page while it is still referenced in the guest’s physical-to-machine (p2m) page tables. (CVE-2025-58143)

Test on XCP-ng 8.3

yum clean metadata --enablerepo=xcp-ng-candidates
yum update --enablerepo=xcp-ng-candidates
reboot

The usual update rules apply: pool coordinator first, etc.

Versions:

xapi: 25.6.0-1.12.xcpng8.3
xen: 4.17.5-15.3.xcpng8.3

What to test

Normal use and anything else you want to test.

Test window before official release of the updates

~2 days.

olivierlambert

It's hard to tell what's going on. So to avoid any environment issue, deploy quickly an XOA free, create a VM and see from there.

yann

@john.c OK, that will be useful when the repo is signed, but for now I don't see what adverse effect it can have. Do I miss something?

Also we try to avoid breaking support for older OS versions, so we'll likely continue to advertise the old format for older versions of Debian.

olivierlambert

That's an OS issue, as I said. You need to mount it in another VM as an extra drive, or use a LiveCD to explore the filesystem

olivierlambert

I would check inside the OS that cannot boot anymore, running an fsck

That's what I would do

olivierlambert

To me, you have an issue inside your OS. You can try to mount the disk of this VM in another VM and try to check what's going on, maybe do a file system check or something.

olivierlambert

@rustylh Can you try another kernel version or a safe mode if available in the Grub menu of your VM? It seems the OS cannot boot anymore, for whatever reason happened inside the VM.

olivierlambert

Are you sure the VM operating system isn't crashing? Are you seeing anything during boot phase?

O	olivierlambert
A	antoinemottier
N	nathanael-h
M	ManonMercier
Y	yann
D	dthenot
F	fohdeesha
M	MathieuRA
D	Danp
P	pdonias
R	ronan-a
B	BenjiReis
G	gduperrey
M	marcungeschikts
D	Darkbeldin
J	julien-f
M	Marc.pezin
B	borzel
S	stormi

administrators

Posts

New security update candidates for you to test!

Test on XCP-ng 8.2

Versions:

What to test

Test window before official release of the updates

Remarks

New security update candidates for you to test!

Test on XCP-ng 8.3

Versions:

What to test

Test window before official release of the updates

Member List