distronews.com stable7.2.15 mainline7.4-rc1
Qubes OS News

QSB-121: Arbitrary read/write via grant copy (XSA-523)

qubes-os.org

Key points

Qubes OS has published Qubes Security Bulletin 121 for XSA-523, a pair of Xen flaws in grant copy handling that let a malicious qube read and write arbitrary memory of other qubes, including dom0. All supported Qubes OS releases are affected. Fixed Xen packages for Qubes 4.3 are in the security-testing repository.

The vulnerabilities

  • The Xen Project published XSA-523, "arbitrary read/write via grant copy", on 2026-11-03. It covers CVE-2026-102703 and CVE-2026-102704.
  • For performance, Xen caches validated data when a batch of Grant Copy operations works on adjacent ranges of the same page. The rules for re-validating that cache were wrong in some cases.
  • CVE-2026-102703: frame numbers and grant references could be mixed up.
  • CVE-2026-102704: copying by frame number is only allowed on the caller's own memory, but the check enforcing this was misplaced.

Impact

  • A malicious qube can read and write arbitrary memory belonging to other qubes, including dom0.
  • Every supported Qubes OS release and configuration is affected.

Patching

  • Qubes 4.3, in dom0: Xen packages version 4.19.6-3.
  • The packages move from security-testing to the current (stable) repository over the next two weeks, after community testing.
  • Once available, install them with the Qubes Update tool or its command-line equivalents, then restart dom0.
  • Anti Evil Maid users must reseal their secret passphrase, because the new Xen binaries change PCR18 and PCR19.
  • No other user action is required: keep updating normally.

Verifying the bulletin

  • The QSB is signed by Marek Marczykowski-Górecki and Simon Gaiser. After importing and authenticating the Qubes Master Signing Key and the qubes-secpack keys, the signatures can be checked in the QSBs/ folder of qubes-secpack:
$ gpg --verify qsb-121-2026.txt.sig.marmarek qsb-121-2026.txt
$ gpg --verify qsb-121-2026.txt.sig.simon qsb-121-2026.txt
  • The same day's XSA notice lists XSA-523 as the only advisory in this batch, and it affects Qubes OS.

Summary by DistroNews, based on the original post.

We have published Qubes Security Bulletin (QSB) 121: Arbitrary read/write via grant copy (XSA-523). The text of this QSB and its accompanying cryptographic signatures are reproduced below, followed by a general explanation of this announcement and authentication instructions. Qubes Security Bulletin 121 ---===[ Qubes Security Bulletin 121 ]===--- 2026-11-03 Arbitrary read/write via grant copy (XSA-523) User action ------------ Continue to update normally [1] in order to receive the security updates described in the "Patching" section below. No other user action is required in response to this QSB. Summary -------- On 2026-11-03, the Xen Project published XSA-523, "arbitrary read/write via grant copy" (CVE-2026-102703,CVE-2026-102704) [3]: | A common access pattern is a batch of Grant Copy operations acting on | adjacent address ranges in the same source or destination page. For | performance reasons, Xen caches details internally to reuse already | validated data. The conditions on when to re-validate the internal | data were not correct in some cases: | | - Frame numbers and grant references could wrongly be mixed up. This | is CVE-2026-102703. | | - Copying by frame number (rather than grant reference) is permitted | only when operating on the caller's own memory. The check to | enforce this restriction was misplaced. This is CVE-2026-102704. Impact ------- A malicious qube can read and write arbitrary memory belonging to other qubes, including dom0. Affected systems ----------------- All supported Qubes OS releases and configurations are affected. Patching --------- The following packages contain security updates that address the vulnerabilities described in this bulletin: For Qubes 4.3, in dom0: - Xen packages, version 4.19.6-3 These packages will migrate from the security-testing repository to the current (stable) repository over the next two weeks after being tested by the community.

This is the opening of the story. The full text is on the original page.

Read the original at qubes-os.org