{"name":"xen-slim","summary":"Xen Project Hypervisor (Without Internal Components)","description":"Slimmed-down version of the Xen Project Hypervisor that reuses nixpkgs packages\nas much as possible. Instead of using the Xen Project forks for various internal\ncomponents, this version uses `seabios`, `ovmf` and `ipxe` from Nixpkgs. These\ncomponents may ocasionally get out of sync with the hypervisor itself, but this\nbuilds faster and uses less space than the default derivation.\n\nUse with `qemu_xen_4_19` or `qemu_xen`.\n\nIncludes:\n* `xen.efi`: The Xen Project's [EFI binary](https://xenbits.xenproject.org/docs/4.19-testing/misc/efi.html), available on the `boot` output of this package.\n\nThis Xen Project Hypervisor (4.19.0) has been patched against the following known security vulnerabilities:\n* [Xen Security Advisory #460](https://xenbits.xenproject.org/xsa/advisory-460.html): **Error handling in x86 IOMMU identity mapping.**\n  >Certain PCI devices in a system might be assigned Reserved Memory\nRegions (specified via Reserved Memory Region Reporting, \"RMRR\") for\nIntel VT-d or Unity Mapping ranges for AMD-Vi.  These are typically used\nfor platform tasks such as legacy USB emulation.\nSince the precise purpose of these regions is unknown, once a device\nassociated with such a region is active, the mappings of these regions\nneed to remain continuouly accessible by the device.  In the logic\nestablishing these mappings, error handling was flawed, resulting in\nsuch mappings to potentially remain in place when they should have been\nremoved again.  Respective guests would then gain access to memory\nregions which they aren't supposed to have access to.\n\n  Fixes:\n  * [CVE-2024-31145](https://www.cve.org/CVERecord?id=CVE-2024-31145)\n* [Xen Security Advisory #461](https://xenbits.xenproject.org/xsa/advisory-461.html): **PCI device pass-through with shared resources.**\n  >When multiple devices share resources and one of them is to be passed\nthrough to a guest, security of the entire system and of respective\nguests individually cannot really be guaranteed without knowing\ninternals of any of the involved guests.  Therefore such a configuration\ncannot really be security-supported, yet making that explicit was so far\nmissing.\n\n  Fixes:\n  * [CVE-2024-31146](https://www.cve.org/CVERecord?id=CVE-2024-31146)\n* [Xen Security Advisory #462](https://xenbits.xenproject.org/xsa/advisory-462.html): **x86: Deadlock in vlapic_error().**\n  >In x86's APIC (Advanced Programmable Interrupt Controller) architecture,\nerror conditions are reported in a status register.  Furthermore, the OS\ncan opt to receive an interrupt when a new error occurs.\n\nIt is possible to configure the error interrupt with an illegal vector,\nwhich generates an error when an error interrupt is raised.\n\nThis case causes Xen to recurse through vlapic_error().  The recursion\nitself is bounded; errors accumulate in the the status register and only\ngenerate an interrupt when a new status bit becomes set.\n\nHowever, the lock protecting this state in Xen will try to be taken\nrecursively, and deadlock.\n\n  Fixes:\n  * [CVE-2024-45817](https://www.cve.org/CVERecord?id=CVE-2024-45817)","homepage_url":"https://xenproject.org/","license":"CC-BY-4.0","attribute_paths":["xen-slim"],"releases":[{"version":"4.19.0","last_updated":"2024-10-06T12:21:13Z","platforms":[{"arch":"x86-64","os":"Linux","system":"x86_64-linux","attribute_path":"xen-slim","commit_hash":"50b3bd3fed0442bcbf7f58355e990da84af1749d","date":"2024-10-06T12:21:13Z","outputs":[{"name":"out","path":"/nix/store/amn1afa4r26ks2zsr4154bxgzi3n7ira-xen-4.19.0","default":true},{"name":"man","path":"/nix/store/1p4zjdkjvbxhcy07f3l1pc53fcm6il8k-xen-4.19.0-man","default":true},{"name":"boot","path":"/nix/store/l9xcl6q2q4mg00y5kjw9jxn566n84dcd-xen-4.19.0-boot"},{"name":"dev","path":"/nix/store/nm191v38a05ax90rjr9j38l6m2z3ij3v-xen-4.19.0-dev"},{"name":"doc","path":"/nix/store/4cnnrlg5zdm7gwlkgqd52m6k93rc3v4s-xen-4.19.0-doc"}],"broken":false,"insecure":false}],"platforms_summary":"Linux","outputs_summary":"man (Linux only), out (Linux only), boot (Linux only), dev (Linux only), doc (Linux only)","prerelease":false,"broken":false,"insecure":false},{"version":"4.15.1","last_updated":"2024-08-01T02:09:53Z","platforms":[{"arch":"x86-64","os":"Linux","system":"x86_64-linux","attribute_path":"xen-slim","commit_hash":"799bc8d7b16e6779f0105713e6794899133c4a38","date":"2024-08-01T02:09:53Z","outputs":[{"name":"out","path":"/nix/store/am9665808hwgcf7jfr6ivl085m22vw5x-xen-4.15.1","default":true}],"broken":false,"insecure":true}],"platforms_summary":"Linux","outputs_summary":"","prerelease":false,"broken":false,"insecure":true},{"version":"4.10.4","last_updated":"2022-01-26T13:01:16Z","platforms":[{"arch":"x86-64","os":"Linux","system":"x86_64-linux","attribute_path":"xen-slim","commit_hash":"e722007bf05802573b41701c49da6c8814878171","date":"2022-01-26T13:01:16Z","outputs":[],"broken":false,"insecure":false}],"platforms_summary":"Linux","outputs_summary":"","prerelease":false,"broken":false,"insecure":false},{"version":"4.8.5","last_updated":"2020-11-27T00:06:05Z","platforms":[{"arch":"x86-64","os":"Linux","system":"x86_64-linux","attribute_path":"xen-slim","commit_hash":"1121b2259b7d66e8c7c5131d1588a48c80ef9e58","date":"2020-11-27T00:06:05Z","outputs":[],"broken":false,"insecure":false}],"platforms_summary":"Linux","outputs_summary":"","prerelease":false,"broken":false,"insecure":false}]}