Critical Vulnerability in Xen Package: Read-Only Disk Access Flaw

xen Updated 02 Oct 2025

Summary

02/07/2018

Disclosed on

N/A

Severity

Yes i

Fix available

Critical

Severity

9.9

CVSS Score

ALPINE-CVE-2018-12892: An issue was discovered in Xen 4.7 through 4.10.x. Affects xen versions < 4.11.0-r0. Fixed in 4.11.0-r0. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Xen is a powerful open-source hypervisor that enables the creation and management of virtual machines. It allows multiple operating systems to run concurrently on a single physical machine, providing isolation and resource management. The Xen package is widely used in cloud computing and virtualization environments. However, it has been found to have a significant vulnerability that affects its ability to enforce read-only access on certain disk images, potentially compromising data integrity.

Vulnerability Detail

An issue was discovered in Xen versions 4.7 through 4.10.x, where libxl fails to pass the readonly flag to qemu when setting up a SCSI disk. This flaw, likely stemming from an erroneous merge conflict resolution, allows malicious guest administrators or users to write to disk images that are supposed to be read-only. The vulnerability specifically affects emulated SCSI disks and is exploitable only in systems using qemu-xen as the device model version. The ramifications include unauthorized data modification and potential system compromise, making it critical to address this issue promptly.

How To Fix

Minimum fixed version

4.11.0-r0

This is the first release that contains the fix.

sudo apk add --upgrade xen

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

As a temporary workaround, avoid using emulated SCSI disks in your Xen configuration until the package is updated. Consider using IDE disks or CDROM devices, which are not affected by this vulnerability.

Conclusion

The identified vulnerability in the Xen package poses a significant risk to data integrity by allowing unauthorized write access to read-only disk images. It is crucial for users to update to the patched version to mitigate this risk. Additionally, utilizing workarounds can help protect systems until the update is applied.

See every vulnerability recorded for xen →