oss-security - Xen Security Advisory 529 v2 (CVE-2026-102705) - XAPI: data-dependent compare function used for Pool Secret

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <E1xQq9U-00000003NIq-0nZf@xenbits.xenproject.org>
Date: Tue, 10 Nov 2026 18:01:00 +0000
From: Xen.org security team <security@....org>
To: xen-announce@...ts.xen.org, xen-devel@...ts.xen.org,
 xen-users@...ts.xen.org, oss-security@...ts.openwall.com
CC: Xen.org security team <security-team-members@....org>
Subject: Xen Security Advisory 529 v2 (CVE-2026-102705) - XAPI:
 data-dependent compare function used for Pool Secret

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

           Xen Security Advisory CVE-2026-102705 / XSA-529
                              version 2

      XAPI: data-dependent compare function used for Pool Secret

UPDATES IN VERSION 2
====================

Public release.

ISSUE DESCRIPTION
=================

XAPI has a bearer token used to authenticate requests made between hosts
in a pool, known as the Pool Secret.

Comparison of this token is performed with a function which has
data-dependent timing.  An attacker may be able to use this as a timing
oracle to infer the value of the Pool Secret.

IMPACT
======

An unauthenticated attacker may be able to infer the value of the Pool
Secret, and gain full access to the pool.

VULNERABLE SYSTEMS
==================

Systems running all versions of XAPI are vulnerable.

MITIGATION
==========

There are no mitigations.

RESOLUTION
==========

Applying the appropriate attached patch resolves this issue.

After deploying the fixed XAPI to all pool members, the Pool Secret can
be regenerated by running `xe pool-secret-rotate`.

xsa529.patch           XAPI master

$ sha256sum xsa529*
a8a595891a113ce04665d6075c2ce2bf1a38d05b2df50e1509cadeabd0f525f2  xsa529.patch
$

DEPLOYMENT DURING EMBARGO
=========================

Deployment of the patches and/or mitigations described above (or
others which are substantially similar) is permitted during the
embargo, even on public-facing systems with untrusted guest users and
administrators.

But: Distribution of updated software is prohibited (except to other
members of the predisclosure list).

Predisclosure list members who wish to deploy significantly different
patches and/or mitigations, please contact the Xen Project Security
Team.

(Note: this during-embargo deployment notice is retained in
post-embargo publicly released Xen Project advisories, even though it
is then no longer applicable.  This is to enable the community to have
oversight of the Xen Project Security Team's decisionmaking.)

For more information about permissible uses of embargoed information,
consult the Xen Project community's agreed Security Policy:
  http://www.xenproject.org/security-policy.html
-----BEGIN PGP SIGNATURE-----

iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmrzWmgMHHBncEB4ZW4u
b3JnAAoJEIP+FMlX6CvZHtwIAIfiXHTw5h+h7UjrIWCuZN53ouEUdJE6V6cWCtsX
KSNBpwm9puAg4kVrqSDRF5Uvrwjx6uxFbNMml5OVsZsdOE7KChNZMDk9hhk9HYXC
yyObt/9gtRIyD84u9CSc66Oa1noIbrx+awMeX5Z8FWVOAMtNJ/Oiz4LQPmk7fNhv
dJCtYVIRBmcCS7AZj9W8H1oQuSd7GOgCLNB4/B0FEKMOWKIWBgzHPFOD4MGWAhFf
DTNi+mu7IjmtkXLqPda59C5vG/NMZ18caqSWTAkkihUDwlsuJvONY4F6Ifw8M1fe
tEniu0Ko+RfdE2EbsZFShdnrWFHvU459oBxhkI+S3PqXODE=
=MQpF
-----END PGP SIGNATURE-----

Download attachment "xsa529.patch" of type "application/octet-stream" (1691 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.