CVE-2026-23557

Any guest can cause xenstored to crash by issuing a XS_RESET_WATCHES command within a transaction due to an assert() triggering. In case xenstored was built with NDEBUG #defined nothing bad will happen, as assert() is doing nothing in this case. Note that the default is not to define NDEBUG for xenstored builds even in release builds of Xen.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.0 / Impact : 4.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://xenbits.xenproject.org/xsa/advisory-484.html	Patch Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/04/28/11	Mailing List Patch Third Party Advisory
http://xenbits.xen.org/xsa/advisory-484.html	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*

History

14 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Cualquier invitado puede hacer que xenstored falle al emitir un comando XS_RESET_WATCHES dentro de una transacción debido a que se activa un assert(). En caso de que xenstored se haya compilado con NDEBUG #definido, no ocurrirá nada malo, ya que assert() no hace nada en este caso. Tenga en cuenta que el valor predeterminado es no definir NDEBUG para las compilaciones de xenstored, incluso en las compilaciones de lanzamiento de Xen.

Information

Published : 2026-05-19 14:16

Updated : 2026-10-14 20:10

NVD link : CVE-2026-23557

Mitre link : CVE-2026-23557

CVE.ORG link : CVE-2026-23557

JSON object : View

Products Affected

xen

xen

CWE

CWE-617

Reachable Assertion

{"id": "CVE-2026-23557", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23557", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-19T14:42:12.994792Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 2.0}]}, "affected": [{"source": "security@xen.org", "affectedData": [{"vendor": "Xen", "product": "Xen", "versions": [{"status": "unknown", "version": "consult Xen advisory XSA-484"}], "defaultStatus": "unknown"}]}], "published": "2026-05-19T14:16:38.817", "references": [{"url": "https://xenbits.xenproject.org/xsa/advisory-484.html", "tags": ["Patch", "Vendor Advisory"], "source": "security@xen.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/04/28/11", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://xenbits.xen.org/xsa/advisory-484.html", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-617"}]}], "descriptions": [{"lang": "en", "value": "Any guest can cause xenstored to crash by issuing a XS_RESET_WATCHES\ncommand within a transaction due to an assert() triggering.\n\nIn case xenstored was built with NDEBUG #defined nothing bad will\nhappen, as assert() is doing nothing in this case. Note that the\ndefault is not to define NDEBUG for xenstored builds even in release\nbuilds of Xen."}, {"lang": "es", "value": "Cualquier invitado puede hacer que xenstored falle al emitir un comando XS_RESET_WATCHES dentro de una transacci\u00f3n debido a que se activa un assert().\n\nEn caso de que xenstored se haya compilado con NDEBUG #definido, no ocurrir\u00e1 nada malo, ya que assert() no hace nada en este caso. Tenga en cuenta que el valor predeterminado es no definir NDEBUG para las compilaciones de xenstored, incluso en las compilaciones de lanzamiento de Xen."}], "lastModified": "2026-10-14T20:10:00.190", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "37DFEBDB-42A9-4A8C-A040-CC08782EF553", "versionStartIncluding": "4.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@xen.org"}