XCP-ng
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login
    1. Home
    2. dinhngtu
    D
    Offline
    • Profile
    • Following 0
    • Followers 1
    • Topics 4
    • Posts 136
    • Groups 4

    dinhngtu

    @dinhngtu

    Vates 🪐 XCP-ng Team
    43
    Reputation
    25
    Profile views
    136
    Posts
    1
    Followers
    0
    Following
    Joined
    Last Online

    dinhngtu Unfollow Follow
    Hypervisor & Kernel Team Xen Guru Vates 🪐 XCP-ng Team

    Best posts made by dinhngtu

    • [Alpha Release] New XCP-ng Windows PV Tools: version 9.0.9000.0 (Testsign)

      Hello,

      We're glad to announce a new Alpha version 9.0.9000.0 of our XCP-ng Windows PV Drivers for Windows 10 1607 or newer, and Windows Server 2016 or newer. Note: this driver release is for testing purposes only. Not for production use!

      The release includes new 9.1-series drivers from Xen Project with new features and stability improvements. We also included a XenClean tool for cleanly removing any existing Xen PV drivers, whether they are installed via XCP-ng, Citrix or Windows Update. Feel free to give it a try!

      We're looking to finalize the drivers and produce a signed, Windows-ready installation package. Your feedback will help us greatly in reaching this goal.

      You'll find the new release on XCP-ng GitHub. Below are the release notes:

      Before Installing

      • This driver release is for testing purposes only. Not for production use!
      • Make backups/snapshots before installing!
      • The drivers in this package are testsigned and require enabling testsigning mode. Disable Secure Boot, then run the included script testsign/install.ps1 as Administrator to configure Windows and install the necessary signer certificates. Your VM will reboot automatically.
      • If you encounter installation/uninstallation errors, please try again with one of the following commands:
      For installing:
      msiexec.exe /i XenDrivers-x64.msi /l*vx install.log
      
      For uninstalling:
      msiexec.exe /x XenDrivers-x64.msi /l*vx uninstall.log
      

      Please include this log along with the file C:\Windows\INF\setupapi.dev.log in your bug report. These files will help us troubleshoot any installation issues.

      Changes since 8.2.2-beta

      • This release is based on upstream 9.1-series drivers, which includes the PV Mouse/Keyboard driver and PV Console Driver. You can access the PV console with the following command from a XCP-ng host:
      xl console -t pv <vmname>
      
      • New installer with clean uninstallation and multiple install/uninstall safety checks.
      • New XenClean utility for cleanly removing XCP-ng and Citrix drivers.
      • Multiple driver stability fixes.
      • Volume Shadow Service Provider is no longer included. (XCP-ng 8.1 and newer no longer support quiescent snapshots)
      • Management Agent is currently not included. Xen Orchestra may show "Management agent not detected", but shutdown and reboot features will work normally. We're looking to bring back features of the management agent in the next releases.

      Help / Community Support

      Please report any errors or BSOD you encounter during testing of this release. Your feedback is very appreciated.

      posted in Development
      D
      dinhngtu
    • XCP-ng Windows PV tools 9.0.9030 Testsign released: now with Rust-based Xen Guest Agent

      edit: Before using XenClean or XenBootFix, please read carefully the instructions on the XCP-ng documentation website!

      Hello all,

      Version 9.0.9030 of the new Windows PV drivers has been released.

      This release brings multiple driver stability fixes, a new Rust-based Xen Guest Agent and the XenBootFix boot repair tool.

      This driver release is for testing purposes only and not for production use. It requires putting the system into testsign mode. (only applies to the drivers themselves, not XenBootFix and XenClean; you can use the two tools separately without any configuration)

      Download the release here: https://github.com/xcp-ng/win-pv-drivers/releases/tag/v9.0.9030

      Release notes are below:

      Before Installing

      • This driver release is for testing purposes only. Not for production use!
      • Make backups/snapshots before installing!
      • The drivers in this package are testsigned and require enabling testsigning mode. Disable Secure Boot, then run the included script testsign/install.ps1 as Administrator to configure Windows and install the necessary signer certificates. Your VM will reboot automatically.
      • If you're running version 9.0.9000.0, we're interested in hearing about your upgrade experience to 9.0.9030.

      Changes since 9.0.9000.0

      • NEW: Includes the new Rust-based Xen Guest Agent for resource and IP address reporting.
      • NEW: Includes the new XenBootFix boot repair tool for VMs rendered unbootable by any Xen drivers (Xen PV, XCP-ng, Citrix, etc.)
      • NOTICE: Xen PV disk drivers are now disabled by default on new installations. The default emulated NVMe driver will be used instead. Existing installations will not be affected.
      • Fixes: Many more installation, uninstallation and upgrade safety checks are now built into the installer.
      • Fixes: Various improvements to XenClean for more complete removal of driver services.
      • Fixes: xenvbd: Xen PV disk drives now report as SSD drives to avoid unnecessary defragmentation (commit)
      • Fixes: xenvif: Fix various VM hanging and crashing issues when changing VM network in Xen Orchestra (commit 1, commit 2)
      • Debug symbols are now included with the installation package.

      Changes since 8.2.2-beta

      • This release is based on upstream 9.1-series drivers, which includes the PV Mouse/Keyboard driver and PV Console Driver. You can access the PV console with the following command from a XCP-ng host:
      xl console -t pv <vmname>
      
      • New installer with clean uninstallation and multiple install/uninstall safety checks.
      • New XenClean utility for cleanly removing XCP-ng and Citrix drivers.
      • Multiple driver stability fixes.
      • Volume Shadow Service Provider is no longer included. (XCP-ng 8.1 and newer no longer support quiescent snapshots)
      • Management Agent is currently not included. Xen Orchestra may show "Management agent not detected", but shutdown and reboot features will work normally. We're looking to bring back features of the management agent in the next releases. Check out the new Rust-based Xen Guest Agent included in our package! We're looking to bring back even more features to the agent.
      • Older Windows versions are no longer supported. The driver requires at a minimum Windows 10 1607 or Windows Server 2016.

      Help / Community Support

      If you encounter installation/uninstallation errors, please try again with one of the following commands:

      For installing:
      msiexec.exe /i XenDrivers-x64.msi /l*vx install.log
      
      For uninstalling:
      msiexec.exe /x XenDrivers-x64.msi /l*vx uninstall.log
      

      Please include this log along with the file C:\Windows\INF\setupapi.dev.log in your bug report. These files will help us troubleshoot any installation issues.

      Additionally, please report any errors or BSOD you encounter during testing of this release. Your feedback is very appreciated.

      • Discussion: https://xcp-ng.org/forum (preferred)
      • Issue Tracker: https://github.com/xcp-ng/xcp/issues
      • IRC: #xcp-ng and #xcp-ng-dev on irc.freenode.net

      Full Changelog: https://github.com/xcp-ng/win-pv-drivers/compare/v9.0.9000.0...v9.0.9030

      posted in Development
      D
      dinhngtu
    • XSA-468: multiple Windows PV driver vulnerabilities - update now!

      XSA-468: multiple Windows PV driver vulnerabilities - update now!

      Original announcement: https://xcp-ng.org/blog/2025/05/27/xsa-468-windows-pv-driver-vulnerabilities/.
      Check the XCP-ng docs for the latest updates.

      Summary

      Multiple vulnerabilities have been discovered in all existing Xen PV drivers for Windows from all vendors (XCP-ng, XenServer, etc.) published prior to the disclosure, on May 2025.

      These vulnerabilities allow unprivileged users to gain system privileges inside Windows guests.

      These issues have the following identifiers:

      • CVE-2025-27462
      • CVE-2025-27463
      • CVE-2025-27464

      Am I affected?

      Windows guests running vulnerable versions of Xen PV drivers are affected. Other guest OSes are not affected.

      To check if you're affected, verify the version of Xen PV drivers in Device Manager.

      💡 Driver version numbers are independent from Xen PV tools package versions. Use the methods below to check the precise driver versions.

      • XCP-ng PV Bus, XCP-ng Interface and XCP-ng PV Console older than 9.0.9065 are affected.
      • XenServer/Citrix PV Bus older than 9.1.11.115; PV Interface older than 9.1.12.94 are affected.
      • Other Xen PV drivers for Windows are also likely affected. If you are using these drivers, verify each vendor's security bulletins for more details.

      You can check for this vulnerability from within the Windows VMs themselves (most precise, recommended) but also from outside the VMs, using tools we built for this purpose.

      💡 If you are reading this article shortly after its publication, it's likely that all of your Windows VMs are vulnerable.
      Once patched, follow these instructions to verify that your VMs are no longer vulnerable.

      Check a Windows VM for vulnerability

      This is the most precise way, but needs to be done per VM.

      • Verify the version numbers in Device Manager.
      • Use the mitigation script published in the XSA-468 advisory in -Scan mode (will only report the vulnerability, not version numbers). See the script for documentation.

      Detect vulnerable VMs at the pool level

      This method requires the latest XCP-ng updates to be applied, in XCP-ng 8.2 and 8.3.

      We developed two features to help you with the handling of these vulnerabilities.

      • A host-side detection script, that you can run in dom0. It will list affected Windows VMs based on their PV driver versions. See the script for documentation.
      • A warning ⚠️ sign next to affected VMs and a vulnerable? filter in Xen Orchestra. These features will be made available very soon, through an update to the stable channel. Keep an eye on the XCP-ng documentation for announcements.

      💡 This detection depends on XAPI accurately reporting PV driver versions. Prior to the recent XCP-ng 8.2 and 8.3 updates released in May 2025, this was not the case. As a result, the detection tools cannot assess VMs that have not been run since the updates were applied. If no driver information is available, a warning will be displayed.

      ⚠️ Only virtual machines (VMs) created using a Windows template—or from templates or VMs originally derived from one—can be detected by these tools. They are designed to help users identify vulnerable VMs that may have been overlooked, forgotten during patching, or restored from backups taken before vulnerability fixes were applied. These tools are not intended to serve as comprehensive detection solutions, so do not rely on them exclusively.

      How to patch my VMs?

      First, create backups and snapshot your VMs before updating.

      If you're using XenServer Windows PV drivers or have enabled the "Manage Citrix PV drivers via Windows Update" feature: Upgrade to XenServer VM Tools 9.4.1 or later.

      If you're using XCP-ng Windows PV drivers 8.2.x, you should use XenClean to remove the existing drivers, then choose one of the following:

      • On a production system, install XenServer VM Tools 9.4.1 or later;
      • If you're not running a production system, and want to test the latest XCP-ng Windows PV drivers: install XCP-ng driver version 9.0.9065 or later. (Note that this requires bringing Windows into test signing mode)

      If you're already using XCP-ng Windows PV drivers 9.0: Install XCP-ng driver version 9.0.9065 or later.

      I can't patch now, what should I do?

      You are encouraged to apply the latest updates as soon as possible.

      If you absolutely cannot update, apply the mitigation script provided by Vates and the Xen Project, available at https://xenbits.xen.org/xsa/advisory-468.html.

      Note that this mitigation script only covers vulnerabilities in the Xen PV Interface driver.

      You should run the mitigation script in Scan mode afterwards to make sure the vulnerability is effectively mitigated.

      How is Vates helping to address this vulnerability?

      This issue was discovered by Vates as part of our investment into upstream Xen development. Vates VMS provides multiple facilities to help users affected this issue:

      • We developed fixes for these vulnerabilities, which have been integrated upstream.
      • We provided a mitigation script for those who cannot install the update.
      • We have added detection logic in Xen Orchestra's latest release channel to actively alert on vulnerable Windows VMs. We also updated XCP-ng 8.2 and 8.3 so that PV driver versions are reported to Xen Orchestra for it to detect vulnerable Windows VMs. See "Am I affected?" above.
      • We have developed a script that can be run in dom0 to perform the same detection, in case Xen Orchestra’s detection logic is not yet available to you. See "Am I affected?" above.
      • We are publishing an alert about the vulnerability inside all Xen Orchestra appliances.
      • We alert about this vulnerability at the beginning of our latest newsletter.

      Why can't I use XCP-ng Windows PV drivers in production?

      The XCP-ng 9.0 drivers aren't signed by Microsoft yet, and thus currently require putting Windows into test mode. As a result, these drivers are not appropriate for production use.

      You may have noticed that the XCP-ng 8.2 Windows drivers can still be used when Secure Boot is disabled. This is due to these drivers being signed before Microsoft changed the driver signing rules and forcing 1st-party driver signatures.

      We are actively working with Microsoft to get the drivers signed (which is a slow process). An announcement will be made as soon as a Microsoft-signed build is available.

      Related links

      • Xen Project announcement: https://xenbits.xen.org/xsa/advisory-468.html
      • XenServer Security Bulletin: https://support.citrix.com/article/CTX692748
      posted in News
      D
      dinhngtu
    • RE: Windows VMGuest changing network cause the guest to crash

      This is a driver bug that we fixed in XCP-ng Windows tools v9.0.9030 but hasn't been integrated by Citrix yet. You can try it out if you're not running a production system.

      posted in Xen Orchestra
      D
      dinhngtu
    • RE: Citrix or XCP-ng drivers for Windows Server 2022

      @manilx You can use the XenClean tool from our 9.0.9000 driver release: https://github.com/xcp-ng/win-pv-drivers/releases/tag/v9.0.9000.0

      Just go into package\XenClean\x64 and run Invoke-XenClean.ps1 as admin, it will remove all existing drivers and automatically reboot.
      Afterwards you can install the Citrix 9.4.0 tools.

      Note: Please make sure to take a snapshot before running the tool.

      posted in XCP-ng
      D
      dinhngtu
    • RE: Citrix or XCP-ng drivers for Windows Server 2022

      You simply install the XenServer tools as usual, making sure to disable driver installing and auto-updating in the setup wizard:
      b2429a17-74ba-4b58-9167-df9d1c0e6599-image.png

      posted in XCP-ng
      D
      dinhngtu
    • RE: XSA-468: multiple Windows PV driver vulnerabilities - update now!

      Hi all,

      Xen Orchestra 5.107.0 (latest channel) and 5.106.4 (stable channel) have been released. They contain the automatic alert and vulnerable? filter for Windows VMs affected by XSA-468.

      posted in News
      D
      dinhngtu
    • RE: Mouse stops responding in XO console (XCP-ng 8.3, Win11 24H2)

      @mickwilli Interesting. It points to a possible issue between QEMU's USB tablet emulation and Windows rather than an issue related to XO.

      posted in XCP-ng
      D
      dinhngtu
    • RE: Cloning Windows VMs

      You should look into using Sysprep, with it you can create a generalized template and specify domain join credentials for joining each new VM.

      posted in XCP-ng
      D
      dinhngtu
    • RE: xenserver - net 9.1.7.65 issues

      It's a known issue with the new Citrix drivers: https://support.citrix.com/s/article/CTX235403-updates-to-xenserver-vm-tools-for-windows-for-xenserver-and-citrix-hypervisor?language=en_US

      It shouldn't happen again in future updates.

      posted in XCP-ng
      D
      dinhngtu

    Latest posts made by dinhngtu

    • RE: XSA-468: multiple Windows PV driver vulnerabilities - update now!

      @flakpyro What do you get from this command?

      xe vm-param-get uuid=<uuid> param-name=PV-drivers-version
      

      @stormi It sounds like the issue we encountered in CI with the management agent not restoring version numbers after migration.

      posted in News
      D
      dinhngtu
    • RE: XSA-468: multiple Windows PV driver vulnerabilities - update now!

      @conitrade-as This is a known issue when upgrading from XS WinPV 9.3.0 and below: https://support.citrix.com/s/article/CTX235403-updates-to-xenserver-vm-tools-for-windows-for-xenserver-and-citrix-hypervisor

      posted in News
      D
      dinhngtu
    • RE: XSA-468: multiple Windows PV driver vulnerabilities - update now!

      @conitrade-as @DustinB Thanks, reported the template issue to XO team.

      posted in News
      D
      dinhngtu
    • RE: XSA-468: multiple Windows PV driver vulnerabilities - update now!

      @conitrade-as I saw that on your Windows 10 VM, the "Manage Citrix PV drivers via Windows Update" option is enabled. That one might have needed a Windows Update to install the fixed drivers. Do you have that option enabled in other VMs?

      posted in News
      D
      dinhngtu
    • RE: XSA-468: multiple Windows PV driver vulnerabilities - update now!

      @DustinB Do you have the newest pool updates? The warning depends on that.

      posted in News
      D
      dinhngtu
    • RE: XSA-468: multiple Windows PV driver vulnerabilities - update now!

      @conitrade-as The XAPI update was backported to 8.2.1 LTS so you could update your hosts for the new display.

      @DustinB If you're coming from old XenServer tools to new, no need to uninstall.

      posted in News
      D
      dinhngtu
    • RE: XSA-468: multiple Windows PV driver vulnerabilities - update now!

      @conitrade-as Installing the XenServer 9.4.1 tools and rebooting (a couple times) will be enough. Do your VMs show as vulnerable (red) or unable to detect (orange)? There are some new host XAPI updates for correcting driver version reporting that are needed for the XO feature to work.

      posted in News
      D
      dinhngtu
    • RE: XSA-468: multiple Windows PV driver vulnerabilities - update now!

      Hi all,

      Xen Orchestra 5.107.0 (latest channel) and 5.106.4 (stable channel) have been released. They contain the automatic alert and vulnerable? filter for Windows VMs affected by XSA-468.

      posted in News
      D
      dinhngtu
    • [Alpha Release] XCP-ng Windows PV tools 9.0.9065 Testsign released

      Hello all,

      Version 9.0.9065 of the new Windows PV drivers has been released.

      This release brings a security fix for XSA-468 (CVE-2025-27462, CVE-2025-27463, CVE-2025-27464) and clipboard support in our Rust Guest Agent.

      This driver release is for testing purposes only and not for production use. It requires putting the system into testsign mode. (only applies to the drivers themselves, not XenBootFix/XenClean/mitigation scripts; you can use these tools separately without any configuration)

      We are actively working with Microsoft to get the drivers signed (which is a slow process). An announcement will be made as soon as a Microsoft-signed build is available.

      Download the release here: https://github.com/xcp-ng/win-pv-drivers/releases/tag/v9.0.9065

      Release notes are below:

      To download XenClean, click here. The ISO download also includes a copy of XenClean and XenBootFix. Remember to carefully read XenClean docs before use.

      Before Installing

      • This driver release is for testing purposes only. Not for production use!
      • Not compatible with the "Manage Citrix PV drivers via Windows Update" option. You must disable this option before installing.
      • Make backups/snapshots before installing!
      • The drivers in this package are testsigned and require enabling testsigning mode. Disable Secure Boot, then run the included script testsign/install.ps1 as Administrator to configure Windows and install the necessary signer certificates. Your VM will reboot automatically.
      • Note: For this release only, extra files (mitigation scripts, testsign scripts) are not included in the ZIP (only in the ISO file). Find them in extras.zip.

      Changes since 9.0.9030.0

      • IMPORTANT: Security fix for XSA-468 (CVE-2025-27462, CVE-2025-27463, CVE-2025-27464). Check the XCP-ng docs or blog announcement for more details.
        • Mitigation and host-side detection scripts are included in the repository and release package.
      • NOTICE: Xen PV disk drivers have been reenabled by default on new installations. If you want to enable Xen PV disk drivers coming from 9.0.9030, you may do so from Add/Remove Programs.
      • NEW: Clipboard support in Rust Guest Agent.
      • Fixes: More improvements to XenClean to support older drivers.
      • Updated branding to follow Vates/XCP-ng brand guidelines.
      • Build automation support.

      Changes since 8.2.2-beta

      • IMPORTANT: Security fix for XSA-468 (CVE-2025-27462, CVE-2025-27463, CVE-2025-27464). Check the XCP-ng docs or blog announcement for more details.

      • This release is based on upstream 9.1-series drivers, which includes the PV Mouse/Keyboard driver and PV Console Driver. You can access the PV console with the following command from a XCP-ng host:

      xl console -t pv <vmname>
      
      • New installer with clean uninstallation and multiple install/uninstall safety checks.
      • New XenClean utility for cleanly removing XCP-ng and Citrix drivers.
      • Multiple driver stability fixes.
      • Volume Shadow Service Provider is no longer included. (XCP-ng 8.1 and newer no longer support quiescent snapshots)
      • Check out the new Rust-based Xen Guest Agent included in our package! We're looking to bring back even more features to the agent.
      • Older Windows versions are no longer supported. The driver requires at a minimum Windows 10 1607 or Windows Server 2016.

      Help / Community Support

      If you encounter installation/uninstallation errors, please try again with one of the following commands:

      For installing:
      msiexec.exe /i XenDrivers-x64.msi /l*vx install.log
      
      For uninstalling:
      msiexec.exe /x XenDrivers-x64.msi /l*vx uninstall.log
      

      Please include this log along with the file C:\Windows\INF\setupapi.dev.log in your bug report. These files will help us troubleshoot any installation issues.

      Additionally, please report any errors or BSOD you encounter during testing of this release. Your feedback is very appreciated.

      • Discussion: https://xcp-ng.org/forum (preferred)
      • Issue Tracker: https://github.com/xcp-ng/xcp/issues
      • IRC: #xcp-ng and #xcp-ng-dev on irc.freenode.net

      Full Changelog: https://github.com/xcp-ng/win-pv-drivers/compare/v9.0.9030...v9.0.9065

      posted in Development
      D
      dinhngtu
    • RE: XSA-468: multiple Windows PV driver vulnerabilities - update now!

      @Forza Yes, all XCP-ng drivers before 9.0.9065 are affected, including 8.2.x.

      There's no need to enable the "Manage Citrix PV drivers via Windows Update" option. You should remove the existing drivers with XenClean and install XenServer drivers 9.4.1 or later. (See the "How to patch my VMs?" section for detailed instructions)

      If updating is absolutely not an option, you can try the mitigation script, but be aware that it's only a bandaid and not meant to be a long-term or complete fix.

      posted in News
      D
      dinhngtu