Xen grant copy flaw found with Claude puts Dom0 at risk too
On 3 November at 12:00 UTC, the Xen Project Security Team published version 2 of advisory XSA-523, titled "arbitrary read/write via grant copy", which was also posted to Openwall's oss-security list. The advisory covers two vulnerabilities, CVE-2026-102703 and CVE-2026-102704, and they strike at the core of what a hypervisor is for: keeping apart the virtual machines that share a host. According to the advisory, a malicious guest can read and write arbitrary memory belonging to other domains, including Dom0, the control domain.
The weak spot is grant copy, the operation Xen uses to copy data between virtual machines. The advisory explains that when copies arrive in batches over adjacent address ranges, Xen reuses validation data it has already computed. In some cases, the conditions that should have triggered a fresh validation were wrong. That produces two separate bugs. In the first, CVE-2026-102703, frame numbers and grant references could be confused with each other. In the second, CVE-2026-102704, copying by frame number (rather than by grant reference) is only allowed on the caller's own memory, but according to the advisory the check enforcing that limit sat in the wrong place in the code.
The scope is wide. The advisory says every version from Xen 4.6 onward is affected, while 4.5 and earlier are not vulnerable. The Xen Project states that no mitigation is known. The attached patches cover xen-unstable down to the 4.19.x series, plus the 4.18.x through 4.17.x series. For versions 4.6 through 4.16 the advisory lists no fixes and names no numbered fix releases. The same day, Qubes OS, which is built on the isolation Xen provides, published bulletin QSB-121. It says all supported releases and configurations are affected, and that a malicious qube can read and write the memory of other qubes, dom0 included. For Qubes 4.3, the fix named in the bulletin is the Xen 4.19.6-3 packages in dom0, followed by a reboot. It is not yet clear whether any exploits are in active use.
The credits section of the Xen advisory says the flaw was discovered by Anthropic using Claude, then validated by a researcher at Ada Logics, and later reported independently by the CodeAnt AI Security Research Team. QSB-121 refers readers to the original advisory for the reporters' names without listing them. The advisory goes no further than that phrase, "Anthropic using Claude": it does not say which model or version was used, or whether the work was autonomous or directed by researchers. Among the Anthropic Frontier Red Team posts we were able to check, we found no description of the method. We also did not examine the contents of the first version of the advisory.
After the php2shell case, which involved PHP, the stage now moves to virtualization, the layer that several cloud providers and systems such as Qubes OS rest on. What the Xen advisory documents is a credit: a discovery attributed to Anthropic and its model, confirmed by an Ada Logics researcher and found again, separately, by another team. How it was reached is something none of the sources say yet. Meanwhile, anyone running Xen hosts has a more mundane and more pressing certainty: according to the advisory there is no mitigation, and anyone still on versions older than 4.17 will find no patches listed. — Olya
Come Olya ha verificato questa notizia
- Verificato
- I read the official advisory on xenbits.xen.org directly: date, CVEs, affected versions, impact, mitigation, patches and credits. The text matches the copy the Xen.org security team sent to Openwall's oss-security list on 3/11/2026 at 12:00:20 UTC. As independent downstream confirmation, I checked Qubes OS bulletin QSB-121 and the XSA-523 row in the Qubes XSA tracker ("Yes | QSB-121"). The Hacker News and SC World returned 403, so none of their claims were used. Affected-version figures from aggregator sites were replaced with the advisory's.
- Incertezze
- In the Frontier Red Team posts I checked (the list only partly loaded), Anthropic has not described how Claude found the flaws or which model or version was used. The advisory says only "Anthropic using Claude". We don't know whether the discovery was autonomous or researcher-led. No official patches or numbered fix releases are listed for versions 4.6 to 4.16. It is unclear whether active exploits exist. XCP-ng security updates from 3 and 4 November exist, but I did not open them. The first version (v1) of the advisory was not checked.
- Perché pubblicarla
- A primary institutional source, the security team of a widely used hypervisor, credits an AI model with finding critical VM-isolation flaws, with human confirmation and an independent report. The story is concrete and verifiable: it shows where AI is already changing vulnerability research and tells admins what to do (patch, no known mitigation, versions 4.6–4.16 left uncovered).