Xen Hypervisor management tools
xen:xen from the port| CVE-2026-23558 | 7.8 | 2026-05-19 | The adjustments made for XSA-379 as well as those subsequently becoming XSA-387 still left a race window, when a HVM or PVH guest does a grant table version change from … |
| CVE-2026-23554 | 7.8 | 2026-03-23 | The Intel EPT paging code uses an optimization to defer flushing of any cached EPT state until the p2m lock is dropped, so that multiple modifications done under the sam… |
| CVE-2023-34319 | 7.8 | 2023-09-22 | The fix for XSA-423 added logic to Linux'es netback driver to deal with a frontend splitting a packet in a way such that not all of the headers would come in one piece. … |
| CVE-2022-42332 | 7.8 | 2023-03-21 | x86 shadow plus log-dirty mode use-after-free In environments where host assisted address translation is necessary but Hardware Assisted Paging (HAP) is unavailable, Xen… |
| CVE-2022-23033 | 7.8 | 2022-01-25 | arm: guest_physmap_remove_page not removing the p2m mappings The functions to remove one or more entries from a guest p2m pagetable on Arm (p2m_remove_mapping, guest_phy… |
| CVE-2021-28701 | 7.8 | 2021-09-08 | Another race in XENMAPSPACE_grant_table handling Guests are permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associat… |
| CVE-2025-58149 | 7.5 | 2025-10-31 | When passing through PCI devices, the detach logic in libxl won't remove access permissions to any 64bit memory BARs the device might have. As a result a domain can sti… |
| CVE-2025-58148 | 7.5 | 2025-10-31 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Some Viridian hypercalls can specify a … |
| CVE-2025-58147 | 7.5 | 2025-10-31 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Some Viridian hypercalls can specify a … |
| CVE-2025-1713 | 7.5 | 2025-07-17 | When setting up interrupt remapping for legacy PCI(-X) devices, including PCI(-X) bridges, a lookup of the upstream bridge is required. This lookup, itself involving acq… |
| CVE-2024-31145 | 7.5 | 2024-09-25 | Certain PCI devices in a system might be assigned Reserved Memory Regions (specified via Reserved Memory Region Reporting, "RMRR") for Intel VT-d or Unity Mapping ranges… |
| CVE-2024-31143 | 7.5 | 2024-07-18 | An optional feature of PCI MSI called "Multiple Message" allows a device to use multiple consecutive interrupt vectors. Unlike for MSI-X, the setting up of these consec… |
| CVE-2024-45817 | 7.3 | 2024-09-25 | In x86's APIC (Advanced Programmable Interrupt Controller) architecture, error conditions are reported in a status register. Furthermore, the OS can opt to receive an i… |
| CVE-2026-23555 | 7.1 | 2026-03-23 | Any guest issuing a Xenstore command accessing a node using the (illegal) node path "/local/domain/", will crash xenstored due to a clobbered error indicator in xenstore… |
| CVE-2021-28692 | 7.1 | 2021-06-30 | inappropriate x86 IOMMU timeout detection / handling IOMMUs process commands issued to them in parallel with the operation of the CPU(s) issuing such commands. In the cu… |
| CVE-2021-28703 | 7.0 | 2021-12-07 | grant table v2 status pages may remain accessible after de-allocation (take two) Guest get permitted access to certain Xen-owned pages of memory. The majority of such pa… |
| CVE-2026-23557 | 6.5 | 2026-05-19 | Any guest can cause xenstored to crash by issuing a XS_RESET_WATCHES command within a transaction due to an assert() triggering. In case xenstored was built with NDEBUG… |
| CVE-2023-46842 | 6.5 | 2024-05-16 | Unlike 32-bit PV guests, HVM guests may switch freely between 64-bit and other modes. This in particular means that they may set registers used to pass 32-bit-mode hype… |
| CVE-2023-46841 | 6.5 | 2024-03-20 | Recent x86 CPUs offer functionality named Control-flow Enforcement Technology (CET). A sub-feature of this are Shadow Stacks (CET-SS). CET-SS is a hardware feature desi… |
| CVE-2022-42319 | 6.5 | 2022-11-01 | Xenstore: Guests can cause Xenstore to not free temporary memory When working on a request of a guest, xenstored might need to allocate quite large amounts of memory tem… |
| CVE-2018-5244 | 6.5 | 2018-01-05 | In Xen 4.10, new infrastructure was introduced as part of an overhaul to how MSR emulation happens for guests. Unfortunately, one tracking structure isn't freed when a v… |
| CVE-2022-33748 | 5.6 | 2022-10-11 | lock order inversion in transitive grant copy handling As part of XSA-226 a missing cleanup call was inserted on an error handling path. While doing so, locking requirem… |
| CVE-2024-45819 | 5.5 | 2024-12-19 | PVH guests have their ACPI tables constructed by the toolstack. The construction involves building the tables in local memory, which are then copied into guest memory. … |
| CVE-2023-34327 | 5.5 | 2024-01-05 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] AMD CPUs since ~2014 have extensions t… |
| CVE-2022-42326 | 5.5 | 2022-11-01 | Xenstore: Guests can create arbitrary number of nodes via transactions T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabili… |
| CVE-2022-42325 | 5.5 | 2022-11-01 | Xenstore: Guests can create arbitrary number of nodes via transactions T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabili… |
| CVE-2021-28699 | 5.5 | 2021-08-27 | inadequate grant-v2 status frames array bounds check The v2 grant table interface separates grant attributes from grant status. That is, when operating in this mode, a g… |
| CVE-2021-28698 | 5.5 | 2021-08-27 | long running loops in grant table handling In order to properly monitor resource use, Xen maintains information on the grant mappings a domain may create to map grants o… |
| CVE-2021-28700 | 4.9 | 2021-08-27 | xen/arm: No memory limit for dom0less domUs The dom0less feature allows an administrator to create multiple unprivileged domains directly from Xen. Unfortunately, the me… |
| CVE-2022-23035 | 4.6 | 2022-01-25 | Insufficient cleanup of passed-through device IRQs The management of IRQs associated with physical devices exposed to x86 HVM guests involves an iterative operation in p… |
| CVE-2025-27465 | 4.3 | 2025-07-16 | Certain instructions need intercepting and emulating by Xen. In some cases Xen emulates the instruction by replaying it, using an executable stub. Some instructions ma… |
| CVE-2023-46840 | 4.1 | 2024-03-20 | Incorrect placement of a preprocessor directive in source code results in logic that doesn't operate as intended when support for HVM guests is compiled out of Xen. |
| CVE-2026-23553 | 2.9 | 2026-01-28 | In the context switch logic Xen attempts to skip an IBPB in the case of a vCPU returning to a CPU on which it was the previous vCPU to run. While safe for Xen's isolatio… |
pkg audit reports nothing for this version.no CVE referenced
{emulators,sysutils}/xen-{kernel,tools}: update to 4.21
Update to latest stable version. Fetch QEMU from the release tarball,
building from git is getting more and more complex, and we don't usually
have a delta of patches on top of QEMU that would dissaper if using git.
Sponsored by: Citrix Systems R&D
Approved by: bapt (implicit)6961b47968python.mk: rename PYTHON_EXT_SUFFIX to PYTHON_TAG, document, etc EXT_SUFFIX, according to PEP 3149, refers to the full tag and extension for compiled extension module objects, eg .cpython-311.so, .cpython-313t.so, etc. We do not use the correct semantic meaning, and this usage becomes ambiguous and confusing when tags do not match between bytecode and compiled extension module objects. Rename our PYTHON_EXT_SUFFIX to PYTHON_TAG to align with PEP 3147's specification of a magic tag, which consists of implementation name and shorthand version only. This is meant for bytecode and other files containing this tag in their filename that do not depend on a specific Python ABI for the same version. Chase all existing consumers. Introduce PYTHON_SOABI to align with PEP 3149's specification of a tag, which consists of implementation name, shorthand version and any ABI flags present (this and PYTHON_TAG are identical without ABI flags). This is meant for compiled extension module objects and other files that depend on a specific Python ABI for the same version. Add documentation for these variables that our PYTHON_EXT_SUFFIX never had. PR: 274671 Event: Kitchener-Waterloo Hackathon 2025064f0eba1efd
sysutils/xen-tools: add GNU TLS dependency The Xen toolstack `vncpasswd` guest configuration option depends on QEMU being built with an external crypto library as of QEMU commit: 21407ddf967f crypto: delete built-in DES implementation Introduce a dependency of the xen-tools package on gnutls, so that the option continues to work as expected. Otherwise when attempting to use `vncpasswd` option guest creation fails due to QEMU not starting. Reported by: Subbsd <subbsd@gmail.com> Sponsored by: Cloud Software Group Approved by: bapt (implicit)d94cb88a40
{emulators,sysutils}/xen-{kernel,tools}: update to 4.19.1.20250217
Update Xen packages, include QEMU fix to avoid using %ms scanf directive
which is not supported by FreeBSD libc.
Link: https://lore.kernel.org/xen-devel/20250107093140.86180-1-roger.pau@citrix.com/
Link: https://lists.freebsd.org/archives/freebsd-xen/2025-February/000227.html
Approved by: bapt (implicit)
Sponsored by: Cloud Software Group049a2dcbdb*/*: Use Gnome helper for defining libxml2 dependency Replace LIB_DEPENDS with USES= gnome, USE_GNOME= libxml2 Approved by: portmgr (blanket)3b3700f8f0
{emulators,sysutils}/xen-{kernel,tools}: update to 4.19.0
Sponsored by: Cloud Software Group
Approved by: bapt (implicit)566a18d032devel/argp-standalone: Update to newer snapshot (8ded2bc) - Bump PORTREVISION for package change - Bump PORTREVISION of dependent ports for shlib change455664cfd6
{emulators,sysutils}/xen-{kernel,tools}: update to 4.8.2
Changelog: https://xenbits.xen.org/gitweb/?p=xen.git;a=shortlog;h=RELEASE-4.18.2
Sponsored by: Cloud Software Group
Approved by: bapt (implicit)80e73db7c8{sysutils,emulators}/xen-{tools,kernel}: update to latest stable hash
Update the kernel and tools packages and also include a fix for a clang code
generation bug.
Sponsored by: Cloud Software Group
Approved by: bapt (implicit)1094417894MANPREFIX: eliminate usage of MANPREFIX While here move some manpages to share/man7074d7f6ae
*/*: Sunset 12.4-RELEASE/12-STABLE from ports tree - Remove all references to defunct ARCH arm - Remove all references to defunct ARCH sparc64 - Remove x11-drivers/xf86-video-sunffb which requires defunct sparc64 ARCH - Remove sysutils/afbinit requires defunct sparc64 ARCH - Remove all references to bktr driver - Remove all references to defunct FreeBSD_12 - Remove all references to OSVERSION/OSREL corresponding to 12 - Remove conditionals in Mk/Uses/cabal.mk - Remove sparc reference from Mk/Uses/qt-dist.mk - Remove BROKEN_sparc64/NOT_FOR_ARCH=sparc64 - Remove BROKEN_FreeBSD_12* from: - Remove OpenSSL patches from: - Remove conditional flags for OSVERSION >= 1300000 to fixed flags. Also move conditional flags for non sparc64/arm ARCH to fixed flags. Reviewed by: brooks, jbeich, rene, salvadore Differential Revision: https://reviews.freebsd.org/D42068bbab7f59e9
emulators/xen-kernel,sysutils/xen-tools: update to 4.18.0 See release notes: https://wiki.xenproject.org/wiki/Xen_Project_4.18_Release_Notes Approved by: bapt (implicit)0ad4440c97
{emulators,sysutils}/xen-{kernel,tools}: update to 4.17.2
Also take the opportunity to switch to fetching the sources from the GitHub
mirror based on commit hash. This makes it easier to update the port when
security fixes or relevant bugfixes are backported to the stable branches,
instead of manually having to cherry pick the changes and add them as patches.
Long term we should look into building emulators/qemu with Xen support so that
the xen-tools package doesn't need to carry its own version of QEMU.
Approved by: bapt (implicit)8b5aa5e081sys-utils/xen-tools: remove usage of signed bitfields When using a single-bit signed bitfield clang complains with: xenalyze.c:6157:17: error: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 Backport fix from upstream Xen. Sponsored by: Citrix System R&D Approved by: bapt (implicit)8d3618a14d
all: remove explicit versions in USES=python for "3.x+"
The logic in USES=python will automatically convert this to 3.8+ by
itself.
Adjust two ports that only had Python 3.7 mentioned but build fine
on Python 3.8 too.
finance/quickfix: mark BROKEN with PYTHON
libtool: compile: c++ -DHAVE_CONFIG_H -I. -I../.. -I -I. -I.. -I../.. -I../C++ -DLIBICONV_PLUG -DPYTHON_MAJOR_VERSION=3 -Wno-unused-variable -Wno-maybe-uninitialized -O2 -pipe -DLIBICONV_PLUG -fstack-protector-strong -fno-strict-aliasing -DLIBICONV_PLUG -Wall -ansi -Wno-unused-command-line-argument -Wpointer-arith -Wwrite-strings -Wno-overloaded-virtual -Wno-deprecated-declarations -Wno-deprecated -std=c++0x -MT _quickfix_la-QuickfixPython.lo -MD -MP -MF .deps/_quickfix_la-QuickfixPython.Tpo -c QuickfixPython.cpp -fPIC -DPIC -o .libs/_quickfix_la-QuickfixPython.o
warning: unknown warning option '-Wno-maybe-uninitialized'; did you mean '-Wno-uninitialized'? [-Wunknown-warning-option]
QuickfixPython.cpp:175:11: fatal error: 'Python.h' file not found
^~~~~~~~~~
1 warning and 1 error generated.
Reviewed by: portmgr, vishwin, yuri
Differential Revision: <https://reviews.freebsd.org/D40568>3d9a815d9c{emulators,sysutils}/xen-{kernel,tools}: update to 4.17
While there also update SeaBIOS to 1.16.1.
Sponsored by: Citrix Systems R&D
Approved by: bapt (implicit)3688ce5f84Remove WWW entries moved into port Makefiles Commit b7f05445c00f has added WWW entries to port Makefiles based on WWW: lines in pkg-descr files. This commit removes the WWW: lines of moved-over URLs from these pkg-descr files. Approved by: portmgr (tcberner)fb16dfecae
Add WWW entries to port Makefiles It has been common practice to have one or more URLs at the end of the ports' pkg-descr files, one per line and prefixed with "WWW:". These URLs should point at a project website or other relevant resources. Access to these URLs required processing of the pkg-descr files, and they have often become stale over time. If more than one such URL was present in a pkg-descr file, only the first one was tarnsfered into the port INDEX, but for many ports only the last line did contain the port specific URL to further information. There have been several proposals to make a project URL available as a macro in the ports' Makefiles, over time. This commit implements such a proposal and moves one of the WWW: entries of each pkg-descr file into the respective port's Makefile. A heuristic attempts to identify the most relevant URL in case there is more than one WWW: entry in some pkg-descr file. URLs that are not moved into the Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr files in order to preserve them. There are 1256 ports that had no WWW: entries in pkg-descr files. These ports will not be touched in this commit. The portlint port has been adjusted to expect a WWW entry in each port Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as deprecated. Approved by: portmgr (tcberner)b7f05445c0
textproc/libxml2: bump all LIB_DEPENDS consumers This is a separate commit to facilitate easier cherry-picking for quarterly. PR: 262853, 262940, 262877, 263126 Approved by: fluffy (mentor)d63665f7cd
{emulators,sysutils}/xen-{kernel,tools}: update to 4.16.0
Add fixes for XSA-{395,398} and backport clang retpoline support from
unstable.
Sponsored by: Citrix Systems R&D
Approved by: bapt (implicit)b717e68780textproc/libxml2: bump all dependencies This should make sure that all dependent ports will pick up the new version commited with a13ec21cd733f67a9fc0dc00ab45268bdc236246247c7db751
sysutils/xen-tools: fix build with clang 13.0.0 Sponsored by: Citrix Systems R&D Approved by: bapt (implicit)e050de4b9c
Style: improve ONLY_FOR_ARCHS_REASON (grammar, markup, etc.) ONLY_FOR_ARCHS_REASON is used as part of the sentence and thus should start with lower-case letter and not end with a period which is added by the framework, similar to other knobs like BROKEN, IGNORE, et al. While here, remove needless quoting, add missing Oxford comma, expand contractions and jargonisms, use correct spelling for proper names.61b6613393
cleanup: drop support for EOL FreeBSD 11.X Search criteria used: - 11.4 - OSREL* - OSVER* - *_FreeBSD_11 Input from: - adridg: devel/qca-legacy - jbeich: _WITH_DPRINTF, _WITH_GETLINE, GNU bfd workarounds - sunpoet: security/p5-*OpenSSL* Reviewed by: doceng, kde, multimedia, perl, python, ruby, rust Differential Revision: https://reviews.freebsd.org/D32008 Test Plan: make index620968a43a
sysutils/xen-tools: fix build with go installed Unconditionally disable building the Go bindings. Such bindings should be packaged in a separate port. PR: 256978 Reported by: Ting-Wei Lan <lantw44@gmail.com> Approved by: bapt (implicit)53c01d6598
sysutils/xen-tools: improve ivshmem check There's no need to check twice for OPSYS, as there's already a check for OPSYS being FreeBSD in the makefile. Also bump the port revision. Approved by: bapt (implicit)8790f67654
sysutils/xen-tools: fix build on FreeBSD 12 QEMU Inter-VM shared memory device (ivshmem) depends on eventfd and will only be built on FreeBSD versions > 12. The fix is picked up from the QEMU port. Approved by: bapt (implicit)97632df2b3
xen-tools: Handle DOCS correctly Reviewed by: royger Differential Revision: https://reviews.freebsd.org/D3030654afe88f6e
sysutils/edk2: Rename xen flavor to xen_x64 We might want to have other flavor of this for other xen arches at one point. Reviewed by: royger Differential Revision: https://reviews.freebsd.org/D3027891fcb7ade6
{emulators,sysutils}/xen-{kernel,tools}: update to 4.15.0
Also add support for using UEFI firmware in guests.
Sponsored by: Citrix Systems R&D
Approved by: bapt (implicit)5e92a126a9One more small cleanup, forgotten yesterday. Reported by: lwhsucf118ccf87
Remove # $FreeBSD$ from Makefiles.305f148f48
sysutils/xen-tools: remove markdown depenmdency It's not required since Xen 4.12. Approved by: bapt (implicit)b7098fcfc5
emulators/xen-kernel,sysutils/xen-tools: update to 4.14.1 Sponsored by: Citrix Systems R&D Approved by: bapt (implicit)835ba0b256
sysutils/xen-tools: switch to PYTHON_EXT_SUFFIX7d19537292
sysutils/xen-tools: unbreak packaging Unbreak package with python!=3.7 Switch to use py3.6+ only Use BINARY_ALIAS for python3 Bump PORTREVISION PR: 249541 Submitted by: fluffy Approved by: maintainer (royger)aa70834b93
emulators/xen-kernel & sysutils/xen-tools: update to 4.14.0 Update to latest version and include a build fix for LLVM 11. Approved by: bapt (implicit)4e2c592597
sysutils/xen-tools + emulators/xen-kernel: update to 4.13.1 Sponsored by: Citrix Systems R&D Approved by: bapt (implicit)1e578cd564
sysutils/xen-tools: properly fix Wno-misleading-indentation errors Backport the commit from upstream in order to properly fix Wno-misleading-indentation related errors from the Flex generated libxl disk parser. Sponsored by: Citrix Systems R&D Approved by: bapt (implicit)2f631c77c6
sysutils/xen-tools: fix build with clang and lld 10 Disable QEMU user support, it's not used by Xen and doesn't currently build with lld 10 and the QEMU version shipped by Xen. Also pass -Wno-misleading-indentation to fix the build with clang 10. Approved by: bapt Sponsored by: Citrix Systems R&D Differential revision: https://reviews.freebsd.org/D24482b4094edc76
sysutils/xen-tools: fix makefile typo Add missing strip annotation (-p1) to patch line. Approved by: lwhsu Differential revision: https://reviews.freebsd.org/D2416098d759774f
sysutils/xen-tools: fix build with clang 10.0 Add upstream fix for clang 10.0 build. Sponsored by: Citrix Systems R&D Approved by: lwhsu Differential revision: https://reviews.freebsd.org/D24097d034c97e92
Fix plist With hat: portmgr0b5ae9b12b
xen-{kernel/tools}: update to 4.13
Sponsored by: Citrix Systems R&D
Approved by: bapt
Differential revision: https://reviews.freebsd.org/D23170a6b94a0696sysutils: Add missing USES={gnome,mate,php}b4f4d38cdaxen-{tools/kernel}: update to 4.12.1
Sponsored by: Citrix Systems R&D
Approved by: mat
Differential revision: https://reviews.freebsd.org/D212270d306f24e0xen-{kernel/tools}: switch back to LLVM toolchain
Backport upstream fixes to correctly build Xen using LLVM 8
toolchain.
Note the fixes are not strictly needed for xen-tools since the Xen
shim build is only ever supposed to be booted using the PVH entry
point (and not the multiboot entry points). Yet given LLD8 erratic
behaviour with orphan section placement I think it's best to ensure
proper section placement for the shim also.
Sponsored by: Citrix Systems R&D
Reviewed by: mat
Differential revision: https://reviews.freebsd.org/D208162213382ec7xen: add fixes for XSA-297 (MDS) Sponsored by: Citrix Systems R&D Reviewed by: mat Differential revision: https://reviews.freebsd.org/D20265228d3e5670
xen: update to 4.12 Reviewed by: bapt Sponsored by: Citrix Systems R&D Differential revision: https://reviews.freebsd.org/D200387931facd63
sysutils/xen-tools: add QEMU migration fix Add a QEMU fix to make migration more reliable. Sponsored by: Citrix Systems R&D Reviewed by: novel Differential revision: https://reviews.freebsd.org/D195914b54fba456