grant-table: type confusion in grant-copy

When grant-copy operations are processed, the respective grant may or may

not already be in use by another operation (a mapping or another copy).

For all copy operations the referenced guest frame is looked up. When

another operation is already active for the grant (the grant is "pinned"),

what is being supplied back to actually carry out permission checks and

copy operation may not be consistent: The permission check may be carried

out on a page different from the one involved in the copy.

Affected products

Xen

Xen

consult Xen advisory XSA-500 - UNKNOWN

References

xenbits.xenproject.org

https://xenbits.xenproject.org/xsa/advisory-500.html

GitHub Security Advisories

GHSA-qmxg-rhxf-8273

When grant-copy operations are processed, the respective grant may or may not already be in use...

https://github.com/advisories/GHSA-qmxg-rhxf-8273

When grant-copy operations are processed, the respective grant may or may not already be in use by another operation (a mapping or another copy). For all copy operations the referenced guest frame is looked up. When another operation is already active for the grant (the grant is "pinned"), what is being supplied back to actually carry out permission checks and copy operation may not be consistent: The permission check may be carried out on a page different from the one involved in the copy.

nvd.nist.gov

https://nvd.nist.gov/vuln/detail/CVE-2026-62428

xenbits.xenproject.org

https://xenbits.xenproject.org/xsa/advisory-500.html

xenbits.xen.org

http://xenbits.xen.org/xsa/advisory-500.html

openwall.com

http://www.openwall.com/lists/oss-security/2026/07/28/16

github.com

https://github.com/advisories/GHSA-qmxg-rhxf-8273

JSON source

https://cveawg.mitre.org/api/cve/CVE-2026-62428

Click to expand

{
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "cveMetadata": {
    "cveId": "CVE-2026-62428",
    "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
    "assignerShortName": "XEN",
    "dateUpdated": "2026-07-28T13:34:09.981Z",
    "dateReserved": "2026-07-14T10:28:12.655Z",
    "datePublished": "2026-07-28T12:32:07.573Z",
    "state": "PUBLISHED"
  },
  "containers": {
    "cna": {
      "providerMetadata": {
        "orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
        "shortName": "XEN",
        "dateUpdated": "2026-07-28T12:32:07.573Z"
      },
      "datePublic": "2026-07-28T12:00:00.000Z",
      "title": "grant-table: type confusion in grant-copy",
      "descriptions": [
        {
          "lang": "en",
          "value": "When grant-copy operations are processed, the respective grant may or may\nnot already be in use by another operation (a mapping or another copy).\nFor all copy operations the referenced guest frame is looked up.  When\nanother operation is already active for the grant (the grant is \"pinned\"),\nwhat is being supplied back to actually carry out permission checks and\ncopy operation may not be consistent: The permission check may be carried\nout on a page different from the one involved in the copy."
        }
      ],
      "affected": [
        {
          "vendor": "Xen",
          "product": "Xen",
          "defaultStatus": "unknown",
          "versions": [
            {
              "version": "consult Xen advisory XSA-500",
              "status": "unknown"
            }
          ]
        }
      ],
      "references": [
        {
          "url": "https://xenbits.xenproject.org/xsa/advisory-500.html"
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "An unprivileged guest may be able to elevate its privileges to that of the\nhost.  Information leaks and Denial of Service (DoS) are possible as well."
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "All Xen versions from 4.2 onwards are vulnerable.  Xen versions 4.1 and\nearlier are not vulnerable.\n\nXen versions 4.13 and newer offer a way to build Xen without grant table\nsupport.  Such hypervisors (CONFIG_GRANT_TABLE turned off) are not\nvulnerable."
        }
      ],
      "workarounds": [
        {
          "lang": "en",
          "value": "There is no known mitigation."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "This issue was discovered by Roman S.",
          "type": "finder"
        }
      ]
    },
    "adp": [
      {
        "providerMetadata": {
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE",
          "dateUpdated": "2026-07-28T13:34:09.981Z"
        },
        "title": "CVE Program Container",
        "references": [
          {
            "url": "http://xenbits.xen.org/xsa/advisory-500.html"
          }
        ]
      }
    ]
  }
}