Vulnerability-Lookup

WID-SEC-W-2026-0760

Vulnerability from csaf_certbund - Published: 2026-03-17 23:00 - Updated: 2026-03-26 23:00

Summary

Xen und Citrix Systems XenServer: Mehrere Schwachstellen

Severity

Mittel

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Xen ist ein Virtueller-Maschinen-Monitor (VMM), der Hardware (x86, IA-64, PowerPC) für die darauf laufenden Systeme (Domains) paravirtualisiert. Citrix XenServer ist eine Lösung für das Management, die Konfiguration und den Betrieb virtueller Maschinen auf Servern.

Angriff: Ein lokaler Angreifer kann mehrere Schwachstellen in Xen und Citrix Systems XenServer ausnutzen, um seine Privilegien zu erhöhen, einen Denial-of-Service-Zustand herbeizuführen oder vertrauliche Informationen offenzulegen.

Betroffene Betriebssysteme: - Sonstiges - UNIX

CVE-2026-23554

CVE-2026-23555

References

URL

Category

	https://wid.cert-bund.de/.well-known/csaf/white/2…	self
	https://wid.cert-bund.de/portal/wid/securityadvis…	self
	https://xenbits.xen.org/xsa/advisory-480.html	external
	https://support.citrix.com/support-home/kbsearch/…	external
	https://xenbits.xen.org/xsa/advisory-481.html	external
	https://bodhi.fedoraproject.org/updates/FEDORA-20…	external
	https://bodhi.fedoraproject.org/updates/FEDORA-20…	external
	https://bodhi.fedoraproject.org/updates/FEDORA-20…	external
	https://lists.suse.com/pipermail/sle-security-upd…	external
	https://lists.suse.com/pipermail/sle-security-upd…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Xen ist ein Virtueller-Maschinen-Monitor (VMM), der Hardware (x86, IA-64, PowerPC) f\u00fcr die darauf laufenden Systeme (Domains) paravirtualisiert.\r\nCitrix XenServer ist eine L\u00f6sung f\u00fcr das Management, die Konfiguration und den Betrieb virtueller Maschinen auf Servern.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein lokaler Angreifer kann mehrere Schwachstellen in Xen und Citrix Systems XenServer ausnutzen, um seine Privilegien zu erh\u00f6hen, einen Denial-of-Service-Zustand herbeizuf\u00fchren oder vertrauliche Informationen offenzulegen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-0760 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0760.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-0760 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-0760"
      },
      {
        "category": "external",
        "summary": "Xen Security Advisory 480 vom 2026-03-17",
        "url": "https://xenbits.xen.org/xsa/advisory-480.html"
      },
      {
        "category": "external",
        "summary": "Citrix XenServer Security Update for CVE-2026-23554 vom 2026-03-17",
        "url": "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696350\u0026articleURL=XenServer_Security_Update_for_CVE_2026_23554"
      },
      {
        "category": "external",
        "summary": "Xen Security Advisory 481 vom 2026-03-17",
        "url": "https://xenbits.xen.org/xsa/advisory-481.html"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-2026-8AE1A1C3D7 vom 2026-03-18",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-8ae1a1c3d7"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-2026-F4371B21F0 vom 2026-03-18",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-f4371b21f0"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-2026-F884FD0313 vom 2026-03-26",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-f884fd0313"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:1092-1 vom 2026-03-27",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-March/024965.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:1093-1 vom 2026-03-27",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-March/024964.html"
      }
    ],
    "source_lang": "en-US",
    "title": "Xen und Citrix Systems XenServer: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-03-26T23:00:00.000+00:00",
      "generator": {
        "date": "2026-03-27T09:47:49.142+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.5.0"
        }
      },
      "id": "WID-SEC-W-2026-0760",
      "initial_release_date": "2026-03-17T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-03-17T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-03-18T23:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Fedora aufgenommen"
        },
        {
          "date": "2026-03-26T23:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von Fedora aufgenommen"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "8.4",
                "product": {
                  "name": "Citrix Systems XenServer 8.4",
                  "product_id": "T051820",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:citrix:xenserver:8.4"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "XenServer"
          }
        ],
        "category": "vendor",
        "name": "Citrix Systems"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Fedora Linux",
            "product": {
              "name": "Fedora Linux",
              "product_id": "74185",
              "product_identification_helper": {
                "cpe": "cpe:/o:fedoraproject:fedora:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Fedora"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003e=4.17",
                "product": {
                  "name": "Open Source Xen \u003e=4.17",
                  "product_id": "T051819"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003e=4.17",
                "product": {
                  "name": "Open Source Xen \u003e=4.17",
                  "product_id": "T051819-fixed"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003e=4.18",
                "product": {
                  "name": "Open Source Xen \u003e=4.18",
                  "product_id": "T051821"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003e=4.18",
                "product": {
                  "name": "Open Source Xen \u003e=4.18",
                  "product_id": "T051821-fixed"
                }
              }
            ],
            "category": "product_name",
            "name": "Xen"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "SUSE Linux",
            "product": {
              "name": "SUSE Linux",
              "product_id": "T002207",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:suse_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-23554",
      "product_status": {
        "known_affected": [
          "T002207",
          "T051820",
          "T051821",
          "74185"
        ]
      },
      "release_date": "2026-03-17T23:00:00.000+00:00",
      "title": "CVE-2026-23554"
    },
    {
      "cve": "CVE-2026-23555",
      "product_status": {
        "known_affected": [
          "T002207",
          "74185"
        ]
      },
      "release_date": "2026-03-17T23:00:00.000+00:00",
      "title": "CVE-2026-23555"
    }
  ]
}

CVE-2026-23554 (GCVE-0-2026-23554)

Vulnerability from cvelistv5 – Published: 2026-03-23 06:56 – Updated: 2026-03-23 14:19

Title

Use after free of paging structures in EPT

Summary

The Intel EPT paging code uses an optimization to defer flushing of any cached EPT state until the p2m lock is dropped, so that multiple modifications done under the same locked region only issue a single flush. Freeing of paging structures however is not deferred until the flushing is done, and can result in freed pages transiently being present in cached state. Such stale entries can point to memory ranges not owned by the guest, thus allowing access to unintended memory regions.

Severity ?

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

Assigner

XEN

References

URL

Tags

https://xenbits.xenproject.org/xsa/advisory-480.html

Impacted products

	Vendor	Product	Version
	Xen	Xen	Unknown: consult Xen advisory XSA-480

Date Public ?

2026-03-17 12:00

Credits

This issue was discovered by Roger Pau Monné of XenServer.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-03-23T07:32:25.539Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/03/17/6"
          },
          {
            "url": "http://xenbits.xen.org/xsa/advisory-480.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-23554",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-23T14:18:54.774466Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-367",
                "description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-23T14:19:27.752Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Xen",
          "vendor": "Xen",
          "versions": [
            {
              "status": "unknown",
              "version": "consult Xen advisory XSA-480"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "Xen 4.17 and onwards are vulnerable.  Xen 4.16 and older are not vulnerable.\n\nOnly x86 Intel systems with EPT support are vulnerable.\n\nOnly x86 HVM/PVH guests using HAP can leverage the vulnerability on affected\nsystems."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This issue was discovered by Roger Pau Monn\u00e9 of XenServer."
        }
      ],
      "datePublic": "2026-03-17T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Intel EPT paging code uses an optimization to defer flushing of any cached\nEPT state until the p2m lock is dropped, so that multiple modifications done\nunder the same locked region only issue a single flush.\n\nFreeing of paging structures however is not deferred until the flushing is\ndone, and can result in freed pages transiently being present in cached state.\nSuch stale entries can point to memory ranges not owned by the guest, thus\nallowing access to unintended memory regions."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Privilege escalation, Denial of Service (DoS) affecting the entire host,\nand information leaks."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-23T06:56:52.344Z",
        "orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
        "shortName": "XEN"
      },
      "references": [
        {
          "url": "https://xenbits.xenproject.org/xsa/advisory-480.html"
        }
      ],
      "title": "Use after free of paging structures in EPT",
      "workarounds": [
        {
          "lang": "en",
          "value": "There are no mitigations."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
    "assignerShortName": "XEN",
    "cveId": "CVE-2026-23554",
    "datePublished": "2026-03-23T06:56:52.344Z",
    "dateReserved": "2026-01-14T13:07:36.961Z",
    "dateUpdated": "2026-03-23T14:19:27.752Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-23555 (GCVE-0-2026-23555)

Vulnerability from cvelistv5 – Published: 2026-03-23 06:57 – Updated: 2026-03-23 14:14

Title

Xenstored DoS by unprivileged domain

Summary

Any guest issuing a Xenstore command accessing a node using the (illegal) node path "/local/domain/", will crash xenstored due to a clobbered error indicator in xenstored when verifying the node path. Note that the crash is forced via a failing assert() statement in xenstored. In case xenstored is being built with NDEBUG #defined, an unprivileged guest trying to access the node path "/local/domain/" will result in it no longer being serviced by xenstored, other guests (including dom0) will still be serviced, but xenstored will use up all cpu time it can get.

Severity ?

7.1 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

CWE

CWE-617 - Reachable Assertion

Assigner

XEN

References

URL

Tags

https://xenbits.xenproject.org/xsa/advisory-481.html

Impacted products

	Vendor	Product	Version
	Xen	Xen	Unknown: consult Xen advisory XSA-481

Date Public ?

2026-03-17 12:00

Credits

This issue was discovered by Marek Marczykowski-Góreckiof Invisible Things Lab.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-03-23T07:32:28.482Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/03/17/7"
          },
          {
            "url": "http://xenbits.xen.org/xsa/advisory-481.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-23555",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-23T14:11:41.150968Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-617",
                "description": "CWE-617 Reachable Assertion",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-23T14:14:02.810Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Xen",
          "vendor": "Xen",
          "versions": [
            {
              "status": "unknown",
              "version": "consult Xen advisory XSA-481"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "All Xen systems from Xen 4.18 onwards are vulnerable. Systems up to\nXen 4.17 are not vulnerable.\n\nSystems using the C variant of xenstored are vulnerable. Systems using\nxenstore-stubdom or the OCaml variant of Xenstore (oxenstored) are not\nvulnerable."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This issue was discovered by Marek Marczykowski-G\u00f3reckiof\nInvisible Things Lab."
        }
      ],
      "datePublic": "2026-03-17T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Any guest issuing a Xenstore command accessing a node using the\n(illegal) node path \"/local/domain/\", will crash xenstored due to a\nclobbered error indicator in xenstored when verifying the node path.\n\nNote that the crash is forced via a failing assert() statement in\nxenstored. In case xenstored is being built with NDEBUG #defined,\nan unprivileged guest trying to access the node path \"/local/domain/\"\nwill result in it no longer being serviced by xenstored, other guests\n(including dom0) will still be serviced, but xenstored will use up\nall cpu time it can get."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Any unprivileged domain can cause xenstored to crash, causing a\nDoS (denial of service) for any Xenstore action. This will result\nin an inability to perform further domain administration on the host.\n\nIn case xenstored has been built with NDEBUG defined, an unprivileged\ndomain can force xenstored to be 100% busy, but without harming\nxenstored functionality for other guests otherwise."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-23T06:57:07.653Z",
        "orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
        "shortName": "XEN"
      },
      "references": [
        {
          "url": "https://xenbits.xenproject.org/xsa/advisory-481.html"
        }
      ],
      "title": "Xenstored DoS by unprivileged domain",
      "workarounds": [
        {
          "lang": "en",
          "value": "There is no known mitigation available."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
    "assignerShortName": "XEN",
    "cveId": "CVE-2026-23555",
    "datePublished": "2026-03-23T06:57:07.653Z",
    "dateReserved": "2026-01-14T13:07:36.961Z",
    "dateUpdated": "2026-03-23T14:14:02.810Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

WID-SEC-W-2026-0760

CVE-2026-23554 (GCVE-0-2026-23554)

CVE-2026-23555 (GCVE-0-2026-23555)

Tags

Sightings

Nomenclature