CVE-2026-62430 Details
Description
Accesses to the CMOS memory contents are done using an indirect IO port pair. Therefore Xen needs to cache the guest chosen index, and one of the usages of the index didn't take the necessary locking to avoid concurrent changes. As a result, a guest could change the index after it being checked, causing a subsequent out-of-bound read access to the contents of an array.
A vulnerability in Xen hypervisor versions 3.2 and later allows for an out-of-bounds read in virtual Real-Time Clock (vRTC) emulation. The issue arises because accesses to the CMOS memory are made through an indirect I/O port pair, requiring Xen to cache the guest-selected index. One use of this index lacked proper locking, enabling a guest to modify the index after it had been validated. This flaw could lead to a subsequent out-of-bounds read from an array, exposing Xen data to the guest.
The vulnerability can be mitigated by running only Paravirtualized (PV) or PV Hybrid (PVH) guests. To resolve the issue, apply the appropriate patch available in the Xen advisory XSA-503. Note that this patch should be applied to the tip of the stable branch for released Xen versions.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 28, 2026CISA-ADP
Assessed Jul 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/07/28/19 | CVE | |
| http://xenbits.xen.org/xsa/advisory-503.html | CVE | |
| https://xenbits.xenproject.org/xsa/advisory-503.html | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-362 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Xen | >= 3.2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 28, 2026 | CVE Modified | CVE |
| Jul 28, 2026 | CVE Modified | CISA-ADP |
| Jul 28, 2026 | CVE Modified | CVE |
| Jul 28, 2026 | New CVE Received | [email protected] |