1. Home
  2. Groups
  3. Team - OS Platform & Release

Team - OS Platform & Release

Private

Posts

  • RE: XCP-ng 8.3 updates announcements and testing

    New security and maintenance update candidates for you to test!

    Security vulnerabilities have been detected and fixed for xen and varstored. We also publish other non-urgent updates which we had in the pipe for the next update release.

    Security updates:

    • xen:

      • XSA-477 / VSA-2026-001: A buffer overflow in the Xen shadow tracing code could allow a DomU virtual machine to crash Xen, or potentially escalate privileges.
      • XSA-479 / VSA-2026-003: Some Xen optimizations to avoid clearing internal CPU buffers when not required could allow one guest to leak data of another guest. A mitigation can be applied without the fix by rebooting vulnerable Xen with "spec-ctrl=ibpb-entry=hvm,ibpb-entry=pv" on the Xen command line at the cost of decreased performances.

    • varstored:

      • XSA-478 / VSA-2026-002: Within varstored, there were insufficient compiler barriers, creating TOCTOU issues with data in the shared buffer. An attacker with kernel level access in a VM can escalate privilege via gaining code execution within varstored.

    Maintenance updates:

    • guest-templates-json:

      • Update VM template labels
      • Sync RHEL10 template with XenServer's

    • intel-microcode:

    • kernel: Bug fixes in the NFS and NBD stacks for various deadlocks and other race conditions.

    • qemu: Backport for CVE-2021-3929, fixing a DMA reentrancy flaw in NVMe emulation, that could lead to use-after-free from a malicious guest and potential arbitrary code execution.

    • smartmontools: Update to minor release 7.5

    • swtpm: Synchronize with release 0.7.3-12 from XenServer. No functional changes.

    • xapi: Fix regression on dynamic memory management during live migration, causing VMs not to balloon down before the migration.

    • xcp-ng-release: Prevent remote syslog from being overwritten by system updates.

    XOSTOR
    In addition to the changes in common packages, the following XOSTOR-specific packages received updates:

    • drbd: Reduces the I/O load and time during resync.
    • drbd-reactor: Misc improvements regarding drbd-reactor and events
    • linstor:
      • Resource delete: Fixed rare race condition where a delayed DRBD event causes "resource not found" ErrorReports
      • Misc changes to robustify LINSTOR API calls and checks

    If you are using Xostor, please refer to our documentation for the update method.

    Test on XCP-ng 8.3

    yum clean metadata --enablerepo=xcp-ng-testing,xcp-ng-candidates
yum update --enablerepo=xcp-ng-testing,xcp-ng-candidates
reboot

    The usual update rules apply: pool coordinator first, etc.

    Versions:

    • guest-templates-json: 2.0.15-1.1.xcpng8.3
    • intel-microcode: 20251029-1.xcpng8.3
    • kernel: 4.19.19-8.0.44.1.xcpng8.3
    • qemu: 4.2.1-5.2.15.2.xcpng8.3
    • smartmontools: 7.5-1.xcpng8.3
    • swtpm: 0.7.3-12.xcpng8.3
    • xapi: 25.33.1-2.3.xcpng8.3
    • xcp-ng-release: 8.3.0-36
    • xcp-python-libs: 3.0.10-1.1.xcpng8.3
    • xen: 4.17.5-23.2.xcpng8.3
    • varstored: 1.2.0-3.5.xcpng8.3

    XOSTOR

    • drbd: 9.33.0-1.el7_9
    • drbd-reactor: 1.9.0-1
    • kmod-drbd: 9.2.16-1.0.xcpng8.3
    • linstor: 1.33.0~rc.2-1.el8
    • linstor-client: 1.27.0-1.xcpng8.3
    • python-linstor: 1.27.0-1.xcpng8.3
    • xcp-ng-linstor: 1.2-4.xcpng8.3

    What to test

    Normal use and anything else you want to test.

    Test window before official release of the updates

    2 days max.

    posted in News
    gduperreyG
    gduperrey
  • RE: Remote syslog broken after update/reboot? - Changing it away, then back fixes.

    @MajorP93

    Fix has been merged, expect a package in your updates soon.

    Meanwhile check this notice about upcoming changes regarding remote syslog.

    https://github.com/xcp-ng-rpms/xcp-ng-release/pull/41#issuecomment-3800419449

    rzr opened this pull request in xcp-ng-rpms/xcp-ng-release

    closed Preserve /etc/rsyslog.d/xenserver.conf if present #41

    posted in Compute
    rzrR
    rzr
  • RE: Remote syslog broken after update/reboot? - Changing it away, then back fixes.

    The fix was already high in the priority list anyway, but I'll try to make sure we don't postpone it more. Had I realized sooner, I would have made it so we'd release it earlier.

    According to the package definitions, we even overwrite it each time we update the xcp-ng-release-config package. I'm surprised that we haven't had more support requests.

    I'll see if we can release a quick fix that just leaves the file alone until we apply the change that will move the remote configuration to its own file.

    posted in Compute
    stormiS
    stormi

Member List