{"id":"CVE-2026-62428","state":"PUBLISHED","title":"grant-table: type confusion in grant-copy","description":"When grant-copy operations are processed, the respective grant may or may\nnot already be in use by another operation (a mapping or another copy).\nFor all copy operations the referenced guest frame is looked up.  When\nanother operation is already active for the grant (the grant is \"pinned\"),\nwhat is being supplied back to actually carry out permission checks and\ncopy operation may not be consistent: The permission check may be carried\nout on a page different from the one involved in the copy.","publishedAt":"2026-07-28T12:32:07.573Z","updatedAt":"2026-07-28T16:33:28.183Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","source":"CISA-ADP"},"assigner":"XEN","products":["Xen Xen"],"affected":[{"vendor":"Xen","product":"Xen","defaultStatus":"unknown","versions":[{"version":"consult Xen advisory XSA-500","status":"unknown"}]}],"references":["https://xenbits.xenproject.org/xsa/advisory-500.html","http://xenbits.xen.org/xsa/advisory-500.html","http://www.openwall.com/lists/oss-security/2026/07/28/16"],"weaknesses":["CWE-367"],"ingestedAt":"2026-10-29T20:12:32.778Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/62xxx/CVE-2026-62428.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-62428","state":"PUBLISHED","datePublished":"2026-07-28T12:32:07.573Z","dateUpdated":"2026-07-28T16:33:28.183Z","assignerShortName":"XEN","assignerOrgId":"23aa2041-22e1-471f-9209-9b7396fa234f","dateReserved":"2026-07-14T10:28:12.655Z"},"containers":{"cna":{"title":"grant-table: type confusion in grant-copy","descriptions":[{"lang":"en","value":"When grant-copy operations are processed, the respective grant may or may\nnot already be in use by another operation (a mapping or another copy).\nFor all copy operations the referenced guest frame is looked up.  When\nanother operation is already active for the grant (the grant is \"pinned\"),\nwhat is being supplied back to actually carry out permission checks and\ncopy operation may not be consistent: The permission check may be carried\nout on a page different from the one involved in the copy."}],"affected":[{"vendor":"Xen","product":"Xen","defaultStatus":"unknown","versions":[{"version":"consult Xen advisory XSA-500","status":"unknown"}]}],"references":[{"url":"https://xenbits.xenproject.org/xsa/advisory-500.html"}],"providerMetadata":{"shortName":"XEN","orgId":"23aa2041-22e1-471f-9209-9b7396fa234f","dateUpdated":"2026-07-28T12:32:07.573Z"},"datePublic":"2026-07-28T12:00:00.000Z","impacts":[{"descriptions":[{"lang":"en","value":"An unprivileged guest may be able to elevate its privileges to that of the\nhost.  Information leaks and Denial of Service (DoS) are possible as well."}]}],"configurations":[{"lang":"en","value":"All Xen versions from 4.2 onwards are vulnerable.  Xen versions 4.1 and\nearlier are not vulnerable.\n\nXen versions 4.13 and newer offer a way to build Xen without grant table\nsupport.  Such hypervisors (CONFIG_GRANT_TABLE turned off) are not\nvulnerable."}],"workarounds":[{"lang":"en","value":"There is no known mitigation."}],"credits":[{"lang":"en","type":"finder","value":"This issue was discovered by Roman S."}]},"adp":[{"title":"CVE Program Container","references":[{"url":"http://xenbits.xen.org/xsa/advisory-500.html"},{"url":"http://www.openwall.com/lists/oss-security/2026/07/28/16"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2026-07-28T16:33:28.183Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":7.8,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"HIGH","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-07-28T15:10:28.542416Z","id":"CVE-2026-62428","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-367","type":"CWE","lang":"en","description":"CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-07-28T15:10:53.004Z"}}]}}}