CVE-2026-62430 (GCVE-0-2026-62430)

Vulnerability from cvelistv5 – Published: 2026-07-28 12:32 – Updated: 2026-07-28 16:33
VLAI
Title
x86: Out-of-bounds read in vRTC emulation
Summary
Accesses to the CMOS memory contents are done using an indirect IO port pair. Therefore Xen needs to cache the guest chosen index, and one of the usages of the index didn't take the necessary locking to avoid concurrent changes. As a result, a guest could change the index after it being checked, causing a subsequent out-of-bound read access to the contents of an array.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
XEN
References
Impacted products
Vendor Product Version
Xen Xen Unknown: consult Xen advisory XSA-503
Create a notification for this product.
Date Public
2026-07-28 12:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-07-28T16:33:30.367Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://xenbits.xen.org/xsa/advisory-503.html"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/07/28/19"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-62430",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-28T15:50:31.706627Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-362",
                "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-28T15:50:36.149Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Xen",
          "vendor": "Xen",
          "versions": [
            {
              "status": "unknown",
              "version": "consult Xen advisory XSA-503"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "All Xen versions from 3.2 onwards are vulnerable.  Xen versions 3.1 and\nearlier are not vulnerable."
        }
      ],
      "datePublic": "2026-07-28T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Accesses to the CMOS memory contents are done using an indirect IO port\npair.  Therefore Xen needs to cache the guest chosen index, and one of\nthe usages of the index didn\u0027t take the necessary locking to avoid\nconcurrent changes.  As a result, a guest could change the index after\nit being checked, causing a subsequent out-of-bound read access to the\ncontents of an array."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "An attacker can read out-of-bounds, this is limited to Xen data, and not\ndata belonging to other guests."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T12:32:33.150Z",
        "orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
        "shortName": "XEN"
      },
      "references": [
        {
          "url": "https://xenbits.xenproject.org/xsa/advisory-503.html"
        }
      ],
      "title": "x86: Out-of-bounds read in vRTC emulation",
      "workarounds": [
        {
          "lang": "en",
          "value": "Running only PV or PVH guests will avoid the vulnerability."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
    "assignerShortName": "XEN",
    "cveId": "CVE-2026-62430",
    "datePublished": "2026-07-28T12:32:33.150Z",
    "dateReserved": "2026-07-14T10:28:12.655Z",
    "dateUpdated": "2026-07-28T16:33:30.367Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-62430\",\"sourceIdentifier\":\"security@xen.org\",\"published\":\"2026-07-28T13:19:01.913\",\"lastModified\":\"2026-07-28T17:16:55.220\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Accesses to the CMOS memory contents are done using an indirect IO port\\npair.  Therefore Xen needs to cache the guest chosen index, and one of\\nthe usages of the index didn\u0027t take the necessary locking to avoid\\nconcurrent changes.  As a result, a guest could change the index after\\nit being checked, causing a subsequent out-of-bound read access to the\\ncontents of an array.\"}],\"affected\":[{\"source\":\"security@xen.org\",\"affectedData\":[{\"vendor\":\"Xen\",\"product\":\"Xen\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"consult Xen advisory XSA-503\",\"status\":\"unknown\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-28T15:50:31.706627Z\",\"id\":\"CVE-2026-62430\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"references\":[{\"url\":\"https://xenbits.xenproject.org/xsa/advisory-503.html\",\"source\":\"security@xen.org\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2026/07/28/19\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://xenbits.xen.org/xsa/advisory-503.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "current_release_date": "2026-07-28T18:09:25+00:00",
      "cve": "CVE-2026-62430",
      "id": "CVE-2026-62430",
      "initial_release_date": "2026-07-28T12:32:33.150000+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "xen: Xen: Out-of-bounds read due to concurrent CMOS memory access",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-62430.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://xenbits.xen.org/xsa/advisory-503.html\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2026/07/28/19\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2026-07-28T16:33:30.367Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-62430\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-28T15:50:31.706627Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-362\", \"description\": \"CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-28T14:39:55.981Z\"}}], \"cna\": {\"title\": \"x86: Out-of-bounds read in vRTC emulation\", \"impacts\": [{\"descriptions\": [{\"lang\": \"en\", \"value\": \"An attacker can read out-of-bounds, this is limited to Xen data, and not\\ndata belonging to other guests.\"}]}], \"affected\": [{\"vendor\": \"Xen\", \"product\": \"Xen\", \"versions\": [{\"status\": \"unknown\", \"version\": \"consult Xen advisory XSA-503\"}], \"defaultStatus\": \"unknown\"}], \"datePublic\": \"2026-07-28T12:00:00.000Z\", \"references\": [{\"url\": \"https://xenbits.xenproject.org/xsa/advisory-503.html\"}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Running only PV or PVH guests will avoid the vulnerability.\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Accesses to the CMOS memory contents are done using an indirect IO port\\npair.  Therefore Xen needs to cache the guest chosen index, and one of\\nthe usages of the index didn\u0027t take the necessary locking to avoid\\nconcurrent changes.  As a result, a guest could change the index after\\nit being checked, causing a subsequent out-of-bound read access to the\\ncontents of an array.\"}], \"configurations\": [{\"lang\": \"en\", \"value\": \"All Xen versions from 3.2 onwards are vulnerable.  Xen versions 3.1 and\\nearlier are not vulnerable.\"}], \"providerMetadata\": {\"orgId\": \"23aa2041-22e1-471f-9209-9b7396fa234f\", \"shortName\": \"XEN\", \"dateUpdated\": \"2026-07-28T12:32:33.150Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-62430\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-28T16:33:30.367Z\", \"dateReserved\": \"2026-07-14T10:28:12.655Z\", \"assignerOrgId\": \"23aa2041-22e1-471f-9209-9b7396fa234f\", \"datePublished\": \"2026-07-28T12:32:33.150Z\", \"assignerShortName\": \"XEN\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.