c4patino/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2026-07-06 17:13:24 -05:00
Code Issues Projects Releases Packages Wiki Activity

xen: patch with XSA-492

Browse source 
Xen Security Advisory CVE-2026-42489,CVE-2026-42490 / XSA-492
                               version 3

                       domctl lock open to abuse

To create and manage guests, domctl operations are used by the control
domain, a possible Xenstore domain, or by a domain controlling a
particular guest.  Some of these operations may not be executed in
parallel, so a system-wide lock is used.  The way that lock is acquired
is, however, not providing any fairness.  This is CVE-2026-42489.

Furthermore, with XSM/Flask in use, the lock acquire will, for some
operations, occur ahead of any permission checking.  This is
CVE-2026-42490.

A less privileged entity may stall an equally or more privileged entity,
potentially leading to a Denial od Service (DoS) of up to the entire
host.

https://xenbits.xen.org/xsa/advisory-492.html

Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
This commit is contained in:
Fernando Rodrigues 2026-06-04 14:29:42 +10:00
commit 3d1d9bee16
No known key found for this signature in database
GPG key ID: CC3AE2EA00000000
1 changed files with 74 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

74
pkgs/by-name/xe/xen/package.nix
View file

@ -222,6 +222,80 @@ stdenv.mkDerivation (finalAttrs: {
hash = "sha256-I21YIcaK1v7BfBJi/aiVACgR3QyN+/gXnB4YMprT4zA=";
})
# XSA #492
(fetchpatch {
url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-01.patch";
hash = "sha256-U3nE7jgTKh2HmS9tMVQG+TIGvgU5B1aikC3NSER0CaY=";
})
(fetchpatch {
url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-02.patch";
hash = "sha256-Y3k9ICThfnIcu59F2pFDbFWD5DL6siPJmINmC7nT2uY=";
})
(fetchpatch {
url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-03.patch";
hash = "sha256-k4nPft59/MQwYKcdrzj5d80+LDhp05e86iJWzabjkQc=";
})
(fetchpatch {
url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-04.patch";
hash = "sha256-Mn+8q9zsstXbmrS/rkDdtwWEiD3EGNlmpa+eB1wESA4=";
})
(fetchpatch {
url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-05.patch";
hash = "sha256-csf9nf6cz3skhq1ph8HIs2AEVgBkw29hP39zwqy2vwM=";
})
(fetchpatch {
url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-06.patch";
hash = "sha256-urY9bjqqzKSGqGqEhDnagLUrzDsKkARMERT7vmukeUU=";
})
(fetchpatch {
url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-07.patch";
hash = "sha256-OyUC9bJevxiMuJuyJO9Z3ScXebe7lZM95HkK5YxGino=";
})
(fetchpatch {
url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-08.patch";
hash = "sha256-g3zV+r9LKjuMbkl4gprhWqClOgDU/Kbesr39LQiM+Aw=";
})
(fetchpatch {
url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-09.patch";
hash = "sha256-Wuc5dqwm+zwlYOzDXpRgyQH584sKwETi+xcE7HASHyI=";
})
(fetchpatch {
url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-10.patch";
hash = "sha256-ggln1O+epVOErBSUhIxX7xhwBy808vnQtcae3KYoQdo=";
})
(fetchpatch {
url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-11.patch";
hash = "sha256-/Yb1i/ms8MaVsEa/nK84CTFclOKcJoWMjjQJQab7l40=";
})
(fetchpatch {
url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-12.patch";
hash = "sha256-IpUeM+t7AZ8IVlzake+PiFAe0FCeFzChy+eaN9MAiSM=";
})
(fetchpatch {
url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-13.patch";
hash = "sha256-3vZj9VrDcFtlKrlMy1OD//F+6O252m23jJ0BRShQ6wA=";
})
(fetchpatch {
url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-14.patch";
hash = "sha256-LiBavW+FTfXdELs8Fm79KeOvskRqDXytv/e7eYRgSvY=";
})
(fetchpatch {
url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-15.patch";
hash = "sha256-0eK2hIFPNDIfv2W0ivkGL8Z3F+NpN4p2X0JVKjeBYWE=";
})
(fetchpatch {
url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-16.patch";
hash = "sha256-iEEkPC9mIuSF6Swt3/myUizsc8DubSPEkLkf1zm0/NE=";
})
(fetchpatch {
url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-17.patch";
hash = "sha256-YNo1wr+fRKk8+78Jf/zqJ7q9ugbzg7gyiyJ3zU+nB60=";
})
(fetchpatch {
url = "https://xenbits.xenproject.org/xsa/xsa492/xsa492-4.20-18.patch";
hash = "sha256-qNWe3iw+bYDtvBZ2KVfcy4VKu/waOyhoKZ0L8bqLdNc=";
})
# patch `libxl` to search for `qemu-system-i386` properly. (Before 4.21)
(fetchpatch {
url = "https://github.com/xen-project/xen/commit/f6281291704aa356489f4bd927cc7348a920bd01.diff?full_index=1";