Xen XSA-474: XAPI UTF-8 string handling vulnerability causing DoS

Vulnerability Overview CVE ID: CVE-2025-58146 XSA ID: XSA-474 Published Date: 2025-09-09 12:00 Last Updated: 2025-09-09 12:00 Version: 2 Title: XAPI UTF-8 string handling Issue Description 1. Updates to the XAPI database sanitize input strings, but attempt to generate notifications using the unsanitized input. This causes the database's event thread to terminate and cease further processing. 2. XAPI's UTF-8 encoder implements v3.0 of the Unicode specification, but the libraries used by XAPI conform to the stricter v2.1 Unicode specification. This causes some strings to be accepted as valid UTF-8 by XAPI but rejected by other libraries in use. Notably, such strings can be entered into the database, after which the database can no longer be loaded. 3. There is no input sanitization for Map/Set updates on objects in the XAPI database. Impact Buggy or malicious inputs to XAPI can cause a Denial of Service (DoS). Affected Systems All versions of XAPI are believed to be vulnerable. Issues 1 and 2 can be leveraged by a guest administrator. Issue 3 can only be leveraged by an authenticated API user. Mitigation There are no mitigations. Credits This issue was discovered by Edwin Török from XenServer. Resolution An updated XAPI, built with the attached patch, needs to be deployed to resolve the issue. If XAPI restarts correctly, no further action is necessary. If bad strings have been entered into the database, XAPI will enter a restart loop, citing the following error in approximately every 4 seconds: To resolve this, the bad characters need to be stripped manually from the database. On dom0, something along the lines of: Patch Information Patch File: SHA256 Hash: Deployment During Embargo Deployment of the patches and/or mitigations described above (or others which are substantially similar) is permitted during the embargo, even on public-facing systems with untrusted guest users and administrators. However, distribution of updated software is prohibited (except to other members of the pre-disclosure list). Pre-disclosure list members who wish to deploy significantly different patches and/or mitigations, please contact the Xen Project Security Team. Notes This during-embargo deployment notice is retained in post-embargo publicly released Xen Project advisories, even though it is then no longer applicable. This is to enable the community to have oversight of the Xen Project Security Team's decision-making. For more information about permissible uses of embargoed information, consult the Xen Project community's agreed Security Policy: http://www.xenproject.org/security-policy.html PGP Signature XenProject.org Security Team

Goal Reached Thanks to every supporter — we hit 100%!

Xen XSA-474: XAPI UTF-8 string handling vulnerability causing DoS