CVE-2026-23555

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23555", "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "state": "PUBLISHED", "assignerShortName": "XEN", "dateReserved": "2026-01-14T13:07:36.961Z", "datePublished": "2026-03-23T06:57:07.653Z", "dateUpdated": "2026-03-23T14:14:02.810Z"}, "containers": {"cna": {"title": "Xenstored DoS by unprivileged domain", "datePublic": "2026-03-17T12:00:00.000Z", "descriptions": [{"lang": "en", "value": "Any guest issuing a Xenstore command accessing a node using the\n(illegal) node path \"/local/domain/\", will crash xenstored due to a\nclobbered error indicator in xenstored when verifying the node path.\n\nNote that the crash is forced via a failing assert() statement in\nxenstored. In case xenstored is being built with NDEBUG #defined,\nan unprivileged guest trying to access the node path \"/local/domain/\"\nwill result in it no longer being serviced by xenstored, other guests\n(including dom0) will still be serviced, but xenstored will use up\nall cpu time it can get."}], "impacts": [{"descriptions": [{"lang": "en", "value": "Any unprivileged domain can cause xenstored to crash, causing a\nDoS (denial of service) for any Xenstore action. This will result\nin an inability to perform further domain administration on the host.\n\nIn case xenstored has been built with NDEBUG defined, an unprivileged\ndomain can force xenstored to be 100% busy, but without harming\nxenstored functionality for other guests otherwise."}]}], "affected": [{"defaultStatus": "unknown", "product": "Xen", "vendor": "Xen", "versions": [{"status": "unknown", "version": "consult Xen advisory XSA-481"}]}], "configurations": [{"lang": "en", "value": "All Xen systems from Xen 4.18 onwards are vulnerable. Systems up to\nXen 4.17 are not vulnerable.\n\nSystems using the C variant of xenstored are vulnerable. Systems using\nxenstore-stubdom or the OCaml variant of Xenstore (oxenstored) are not\nvulnerable."}], "workarounds": [{"lang": "en", "value": "There is no known mitigation available."}], "credits": [{"lang": "en", "type": "finder", "value": "This issue was discovered by Marek Marczykowski-G\u00f3reckiof\nInvisible Things Lab."}], "references": [{"url": "https://xenbits.xenproject.org/xsa/advisory-481.html"}], "providerMetadata": {"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "shortName": "XEN", "dateUpdated": "2026-03-23T06:57:07.653Z"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/03/17/7"}, {"url": "http://xenbits.xen.org/xsa/advisory-481.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-03-23T07:32:28.482Z"}}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-617", "lang": "en", "description": "CWE-617 Reachable Assertion"}]}], "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-23T14:11:41.150968Z", "id": "CVE-2026-23555", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T14:14:02.810Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/03/17/7"}, {"url": "http://xenbits.xen.org/xsa/advisory-481.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-03-23T07:32:28.482Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-23555", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-23T14:11:41.150968Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-617", "description": "CWE-617 Reachable Assertion"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T14:13:08.843Z"}}], "cna": {"title": "Xenstored DoS by unprivileged domain", "credits": [{"lang": "en", "type": "finder", "value": "This issue was discovered by Marek Marczykowski-G\u00f3reckiof\nInvisible Things Lab."}], "impacts": [{"descriptions": [{"lang": "en", "value": "Any unprivileged domain can cause xenstored to crash, causing a\nDoS (denial of service) for any Xenstore action. This will result\nin an inability to perform further domain administration on the host.\n\nIn case xenstored has been built with NDEBUG defined, an unprivileged\ndomain can force xenstored to be 100% busy, but without harming\nxenstored functionality for other guests otherwise."}]}], "affected": [{"vendor": "Xen", "product": "Xen", "versions": [{"status": "unknown", "version": "consult Xen advisory XSA-481"}], "defaultStatus": "unknown"}], "datePublic": "2026-03-17T12:00:00.000Z", "references": [{"url": "https://xenbits.xenproject.org/xsa/advisory-481.html"}], "workarounds": [{"lang": "en", "value": "There is no known mitigation available."}], "descriptions": [{"lang": "en", "value": "Any guest issuing a Xenstore command accessing a node using the\n(illegal) node path \"/local/domain/\", will crash xenstored due to a\nclobbered error indicator in xenstored when verifying the node path.\n\nNote that the crash is forced via a failing assert() statement in\nxenstored. In case xenstored is being built with NDEBUG #defined,\nan unprivileged guest trying to access the node path \"/local/domain/\"\nwill result in it no longer being serviced by xenstored, other guests\n(including dom0) will still be serviced, but xenstored will use up\nall cpu time it can get."}], "configurations": [{"lang": "en", "value": "All Xen systems from Xen 4.18 onwards are vulnerable. Systems up to\nXen 4.17 are not vulnerable.\n\nSystems using the C variant of xenstored are vulnerable. Systems using\nxenstore-stubdom or the OCaml variant of Xenstore (oxenstored) are not\nvulnerable."}], "providerMetadata": {"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "shortName": "XEN", "dateUpdated": "2026-03-23T06:57:07.653Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23555", "state": "PUBLISHED", "dateUpdated": "2026-03-23T14:14:02.810Z", "dateReserved": "2026-01-14T13:07:36.961Z", "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "datePublished": "2026-03-23T06:57:07.653Z", "assignerShortName": "XEN"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Xen", "vendor": "Xen", "versions": [{"status": "unknown", "version": "consult Xen advisory XSA-481"}]}], "source": "security@xen.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:xen:xen:*:*:*:*:*:*:x86:*", "matchCriteriaId": "242BBD5A-0BAE-4F89-8597-7D286D6C9E25", "versionStartIncluding": "4.18.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Any guest issuing a Xenstore command accessing a node using the\n(illegal) node path \"/local/domain/\", will crash xenstored due to a\nclobbered error indicator in xenstored when verifying the node path.\n\nNote that the crash is forced via a failing assert() statement in\nxenstored. In case xenstored is being built with NDEBUG #defined,\nan unprivileged guest trying to access the node path \"/local/domain/\"\nwill result in it no longer being serviced by xenstored, other guests\n(including dom0) will still be serviced, but xenstored will use up\nall cpu time it can get."}, {"lang": "es", "value": "Cualquier invitado que emita un comando de Xenstore accediendo a un nodo utilizando la ruta de nodo (ilegal) '/local/domain/', provocar\u00e1 la ca\u00edda de xenstored debido a un indicador de error sobrescrito en xenstored al verificar la ruta del nodo.\n\nTenga en cuenta que la ca\u00edda es forzada mediante una instrucci\u00f3n assert() fallida en xenstored. En caso de que xenstored se compile con NDEBUG #definido, un invitado sin privilegios que intente acceder a la ruta del nodo '/local/domain/' resultar\u00e1 en que ya no sea atendido por xenstored, otros invitados (incluido dom0) seguir\u00e1n siendo atendidos, pero xenstored consumir\u00e1 todo el tiempo de CPU que pueda obtener."}], "id": "CVE-2026-23555", "lastModified": "2026-06-17T10:21:46.473", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 4.0, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 4.0, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23555", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-23T14:11:41.150968Z", "version": "2.0.3"}}]}, "published": "2026-03-23T07:16:07.330", "references": [{"source": "security@xen.org", "tags": ["Patch", "Vendor Advisory"], "url": "https://xenbits.xenproject.org/xsa/advisory-481.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/03/17/7"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://xenbits.xen.org/xsa/advisory-481.html"}], "sourceIdentifier": "security@xen.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-617"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "unknown", "versions": {"scheme": "generic", "value": "consult Xen advisory XSA-481"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Xen", "source": "cna", "vendor": "Xen"}, "product": "xen", "vendor": "xen"}], "analysis": {"en": {"generated_at": "2026-04-10T21:53:27.599342+00:00", "value": {"mitigation_remediation": ["Verify the Xen hypervisor version in use and consult Xen\u2019s release notes for any post\u2011February\u202f2026 updates that address the Xenstored crash.", "Consider configuring Xen to disallow guest domains from accessing \"/local/domain/\" node paths via custom security policies, if available.", "Monitor the Xenstored process for abnormal CPU usage or crash logs, and isolate or restart the host if the denial of service manifests.", "Maintain an updated inventory of patch status for all Xen components to ensure rapid deployment once a fix is released."], "summary": {"action": "Monitor", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "This vulnerability impacts the Xen hypervisor family, specifically the Xenstored component in all releases that include it. Administrators managing Xen\u2011based virtualized environments should be aware that any Xen installation prior to a patch that addresses the crash logic is vulnerable. Vendor and product names are Xen for the hypervisor.", "description_and_impact": "A non\u2011privileged guest domain can issue a Xenstore command that references the illegal node path \"/local/domain/\". Xenstored verifies the path and, due to a clobbered error indicator, triggers a failing assert() statement. When built with NDEBUG, the assert is disabled and instead the process stalls, consuming all available CPU and ceasing to service additional requests. The result is a denial of service that affects the host and all other virtual machines, as xenstored is no longer responsive during the stall period.", "risk_and_exploitability": "With a CVSS score of 7.1 the flaw is high severity, yet the EPSS score is below 1\u2009%, indicating a low likelihood of exploitation in the wild at the moment. The attack requires only an unprivileged guest within the same host and does not require external network access. The vulnerability is not listed in the CISA KEV catalog, suggesting no widely available exploits as of now. Once a patch is released, the risk drops sharply, but until then, a malicious or compromised guest can exhaust host resources by engaging xenstored."}}}}, "created": "2026-03-24T10:34:55.834088+00:00", "updated": "2026-04-13T14:28:21.865137+00:00", "vendors": ["xen", "xen$PRODUCT$xen"]}