VSA-2026-045: Ineffectual Zenbleed workaround (CVE-2026-79608 / XSA-515)
| Published | Updated | Severity | CVSS 4.0 | Affected products |
|---|---|---|---|---|
| 2026-10-13 | 2026-10-13 | 🔴 Important | Not available yet | - XCP-ng 8.3 |
A vulnerability in the Xen hypervisor's Zenbleed (XSA-433, CVE-2023-20593) mitigation has been discovered. For Vates products, we classify the impact as Important. For details on how we assign severity levels, see our Severity Levels Explained page.
Summary​
The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was reworked to better integrate with other manipulations of the same MSR; the rework introduced an inverted conditional, so the workaround is not applied when needed and vice versa.
Impact​
An attacker can read data from different contexts on the same core, e.g. key material, cipher and plaintext from AES-NI instructions, or the contents of REP-MOVS instructions (commonly used to implement memcpy()).
Status​
- Released
Affected Versions​
- XCP-ng 8.3: Affected, only on systems with an AMD Zen2 microarchitecture running out-of-date microcode.
On Xen upstream, this only affects versions after 4.19.4 and 4.20.3, but XCP-ng's 4.17 have a backport of the fix for XSA-433 and is therefore impacted.
Mitigation​
There is no recommended mitigation. Disabling AVX (cpuid=no-avx or cpuid="host:avx=0") disables the vulnerable instructions but is not recommended, as it degrades performance.
Resolution​
As of 2026-10-13, the xen-* packages for XCP-ng 8.3 have been updated to address this issue.
List of packages fixing this issue:
- XCP-ng 8.3:
xen-4.17.7-2.5.xcpng8.3