Detections
Analytics

Xen: x86 HVM I/O Port List Traversal (XSA-491)

high Nessus Plugin ID 320868

Synopsis

The remote Xen hypervisor installation is missing a security update.

Description

HVM guest I/O port accesses are subject to either emulation or at least translation. Translations are managed by the device model (via XEN_DOMCTL_ioport_mapping), and hence the linked list used may changed at any time. Traversal of those lists (while handling guest I/O port accesses) therefore needs synchronizing with updates, which was missing so far. A device model of a HVM guest can cause a hypervisor crash, causing a Denial of Service (DoS) of the entire host.
Privilege escalation and information leaks cannot be ruled out.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Apply the appropriate patch according to the vendor advisory.

See Also

https://xenbits.xenproject.org/xsa/advisory-491.html

Plugin Details

Severity: High

ID: 320868

File Name: xen_server_XSA-491.nasl

Version: 1.1

Type: Local

Family: Misc.

Published: 6/12/2026

Updated: 6/12/2026

Configuration: Enable paranoid mode

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: Medium

Base Score: 5.7

Vector: CVSS2#AV:L/AC:L/Au:S/C:P/I:P/A:C

CVSS Score Source: CVE-2026-42487

CVSS v3

Risk Factor: High

Base Score: 7.9

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H

Vulnerability Information

CPE: cpe:/o:xen:xen

Required KB Items: installed_sw/Xen Hypervisor, Settings/ParanoidReport

Patch Publication Date: 6/9/2026

Vulnerability Publication Date: 6/9/2026

Reference Information

CVE: CVE-2026-42487

IAVB: 2026-B-0069