Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package xen for openSUSE:Factory checked in at 2026-11-04 19:43:04 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/xen (Old) and /work/SRC/openSUSE:Factory/.xen.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "xen" Wed Nov 4 19:43:04 2026 rev:380 rq:1394713 version:4.22.0_08 Changes: -------- --- /work/SRC/openSUSE:Factory/xen/xen.changes 2026-10-14 18:34:51.739218651 +0200 +++ /work/SRC/openSUSE:Factory/.xen.new.3759290/xen.changes 2026-11-04 19:43:18.987028024 +0100 @@ -1,0 +2,8 @@ +Tue Nov 3 06:35:14 MST 2026 - [email protected] + +- bsc#1288663 - VUL-0: CVE-2026-102703,CVE-2026-102704: xen: + arbitrary read/write via grant copy (XSA-523) + 6ae9cd89-gnttab-complete-checking-in-gnttab_copy_buf_valid.patch + 6ae9cd89-gnttab-move-only-local-domain-may-copy-by-frame-check.patch + +------------------------------------------------------------------- New: ---- 6ae9cd89-gnttab-complete-checking-in-gnttab_copy_buf_valid.patch 6ae9cd89-gnttab-move-only-local-domain-may-copy-by-frame-check.patch ----------(New B)---------- New: arbitrary read/write via grant copy (XSA-523) 6ae9cd89-gnttab-complete-checking-in-gnttab_copy_buf_valid.patch 6ae9cd89-gnttab-move-only-local-domain-may-copy-by-frame-check.patch New: 6ae9cd89-gnttab-complete-checking-in-gnttab_copy_buf_valid.patch 6ae9cd89-gnttab-move-only-local-domain-may-copy-by-frame-check.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ xen.spec ++++++ --- /var/tmp/diff_new_pack.IaCyOH/_old 2026-11-04 19:43:21.167119279 +0100 +++ /var/tmp/diff_new_pack.IaCyOH/_new 2026-11-04 19:43:21.169119363 +0100 @@ -126,7 +126,7 @@ BuildRequires: python-rpm-macros Provides: installhint(reboot-needed) -Version: 4.22.0_06 +Version: 4.22.0_08 Release: 0 Summary: Xen Virtualization: Hypervisor (aka VMM aka Microkernel) License: GPL-2.0-only @@ -173,6 +173,8 @@ Patch10: 6abbe079-pv-map-each-vCPUs-root-page-table-in-its-per-domain-area.patch Patch11: 6abbe20c-gnttab-address-fallout-from-XSA-501.patch Patch12: 6abbe28e-vmx-Rework-#DB-intercept-logic-to-fix-VMEntry-failure-with-BTF.patch +Patch13: 6ae9cd89-gnttab-complete-checking-in-gnttab_copy_buf_valid.patch +Patch14: 6ae9cd89-gnttab-move-only-local-domain-may-copy-by-frame-check.patch # Our platform specific patches Patch400: xen-destdir.patch Patch401: vif-bridge-no-iptables.patch ++++++ 6ae9cd89-gnttab-complete-checking-in-gnttab_copy_buf_valid.patch ++++++ Subject: gnttab: complete checking in gnttab_copy_buf_valid() From: Jan Beulich [email protected] Tue Nov 3 12:03:18 2026 +0000 Date: Tue Nov 3 12:05:13 2026 +0000: Git: f463f6d13f4b078df895b880c2b17581b2b74680 The ->have_grant field needs checking not only ahead of comparing GREFs, but also ahead of comparing MFNs. Else a (likely invalid) GREF from an earlier batch element can be mistaken for a (possibly valid) MFN. This is CVE-2026-102703, part of XSA-523. Fixes: d28f42f2703e ("grant-table: defer releasing pages acquired in a grant copy") Assisted-by: Claude Reported-by: Stephan Lipp <[email protected]> Reported-by: CodeAnt AI Security Research <[email protected]> Signed-off-by: Jan Beulich <[email protected]> Reviewed-by: Andrew Cooper <[email protected]> (cherry picked from commit 266df0688c8a4fc243cd2bfd1f4cb09164f99bff) --- a/xen/common/grant_table.c +++ b/xen/common/grant_table.c @@ -3076,10 +3076,10 @@ static bool gnttab_copy_buf_valid( const struct gnttab_copy_ptr *p, const struct gnttab_copy_buf *b, bool has_gref) { - if ( !b->virt ) + if ( !b->virt || b->have_grant != has_gref ) return 0; if ( has_gref ) - return b->have_grant && p->u.ref == b->ptr.u.ref; + return p->u.ref == b->ptr.u.ref; return p->u.gmfn == b->ptr.u.gmfn; } ++++++ 6ae9cd89-gnttab-move-only-local-domain-may-copy-by-frame-check.patch ++++++ Subject: gnttab: move "only local domain may copy by frame" check From: Jan Beulich [email protected] Tue Nov 3 12:03:18 2026 +0000 Date: Tue Nov 3 12:05:13 2026 +0000: Git: d7ddb103825139c09bdafedc190712b877ebffd2 gnttab_copy_one() calls gnttab_copy_lock_domain{s,}() only conditionally. The non-GREF check towards the requestor being DOMID_SELF, however, needs doing on every batch element. Move the check into gnttab_copy_claim_buf() to achieve that. This is CVE-2026-102704, part of XSA-523. Fixes: d28f42f2703e ("grant-table: defer releasing pages acquired in a grant copy") Assisted-by: Claude Reported-by: Stephan Lipp <[email protected]> Reported-by: CodeAnt AI Security Research <[email protected]> Signed-off-by: Jan Beulich <[email protected]> Reviewed-by: Andrew Cooper <[email protected]> (cherry picked from commit cd4d68f86cb111e2ea0a17cfb4fb8cd9c6c69e83) --- a/xen/common/grant_table.c +++ b/xen/common/grant_table.c @@ -2929,13 +2929,8 @@ struct gnttab_copy_buf { bool have_type; }; -static int gnttab_copy_lock_domain(domid_t domid, bool is_gref, - struct gnttab_copy_buf *buf) +static int gnttab_copy_lock_domain(domid_t domid, struct gnttab_copy_buf *buf) { - /* Only DOMID_SELF may reference via frame. */ - if ( domid != DOMID_SELF && !is_gref ) - return GNTST_permission_denied; - buf->domain = rcu_lock_domain_by_any_id(domid); if ( !buf->domain ) @@ -2967,12 +2962,10 @@ static int gnttab_copy_lock_domains(cons { int rc; - rc = gnttab_copy_lock_domain(op->source.domid, - op->flags & GNTCOPY_source_gref, src); + rc = gnttab_copy_lock_domain(op->source.domid, src); if ( rc < 0 ) goto error; - rc = gnttab_copy_lock_domain(op->dest.domid, - op->flags & GNTCOPY_dest_gref, dest); + rc = gnttab_copy_lock_domain(op->dest.domid, dest); if ( rc < 0 ) goto error; @@ -3035,6 +3028,9 @@ static int gnttab_copy_claim_buf(const s buf->ptr.u.ref = ptr->u.ref; buf->have_grant = 1; } + /* Only DOMID_SELF may reference via frame. */ + else if ( ptr->domid != DOMID_SELF ) + return GNTST_permission_denied; else { rc = get_paged_frame(ptr->u.gmfn, &buf->mfn, &buf->page,
