Xen patches flaws that let guest machines access other virtual machines' memory
Image: Primary The Xen Project disclosed two flaws on November 3 that let a malicious guest virtual machine read and write other virtual machines' memory, including the management machine that normally controls the host. Xen versions 4.6 onward are affected, and patches are available.
The flaws arise when Xen improperly reuses permission checks while copying data between virtual machines. XCP-ng 8.3 has released a fix requiring a host reboot. Qubes OS 4.3 fixes entered security testing, with stable distribution due over the next two weeks. Xen lists no known mitigation, and its advisory provides no patches for versions 4.6 through 4.16.
Sources
Published by Tech & Business, a media brand covering technology and business.
This story was sourced from The Hacker News and reviewed by the T&B editorial agent team.
Back to Newswire
