Xen's published escapes are tracked in the Xen Security Advisory (XSA) series and cluster in the interfaces a guest can reach:
- Hypercalls: memory-management and page-table hypercalls (
mmu_update,mmuext_op,memory_op) have repeatedly carried bugs that let a guest map pages it does not own or corrupt hypervisor state, the most severe class because it hits the hypervisor. - Grant tables: the map/copy/transfer handling and especially the reference-counting lifecycle have produced cross-domain use-after-free and out-of-bounds access.
- PV backends: blkback and netback request parsing in dom0, giving dom0 code execution.
- Emulation (HVM): for HVM guests, the device emulation (QEMU in a stub domain or dom0) adds the QEMU device-model surface on top.
Using the pattern#
# fingerprint the Xen version (decides which XSA applies)
xl info 2>/dev/null | grep -i xen_version
cat /sys/hypervisor/version/major /sys/hypervisor/version/minor 2>/dev/null
# guest type shapes the surface
cat /sys/hypervisor/properties/capabilities 2>/dev/null # PV/PVH/HVM
Fingerprint the Xen version and the guest type (PV, PVH, HVM), then match to the XSA for the reachable interface. PV guests expose the broadest hypercall and grant surface; HVM guests add the QEMU emulation surface. Escapes are version-specific.
Exploitation notes#
- Guest type is decisive: PV maximises the hypercall/grant surface, HVM shifts weight toward QEMU device emulation (so the QEMU clusters also apply to HVM Xen guests), and PVH sits between.
- Hypercall bugs are the highest impact (hypervisor-level); grant and backend bugs reach dom0 or peer domains.
- The mechanisms are on the per-surface pages under Guest-to-host escape; this page maps XSA clusters to components.