-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

            Xen Security Advisory CVE-2026-62431 / XSA-504
                               version 2

                   Viridian STIMER division by zero

UPDATES IN VERSION 2
====================

Public release.

ISSUE DESCRIPTION
=================

The logic to handle periodic Viridian STIMERs performs a division with an
unchecked user-controlled divisor value, that can be set to zero to cause a #DE
fault.

IMPACT
======

Enabling Viridian STIMERs to unprivileged HVM guests can result in a Denial
of Service (DoS) affecting the entire host.

VULNERABLE SYSTEMS
==================

All Xen versions from 4.13 onwards are vulnerable.  Xen versions 4.12 and
earlier are not vulnerable.

Only HVM guests with Viridian STIMERs enabled can trigger the vulnerability.

MITIGATION
==========

Not enabling Viridian STIMERs for HVM guests will avoid the vulnerability.

Note Viridian extensions are not enabled by default.

RESOLUTION
==========

Applying the attached patch resolves this issue.

Note that patches for released versions are generally prepared to
apply to the stable branches, and may not apply cleanly to the most
recent release tarball.  Downstreams are encouraged to update to the
tip of the stable branch before applying these patches.

xsa504.patch           xen-unstable - Xen 4.17.x

$ sha256sum xsa504*
cc142e53866a27f3c97bd8532f42df2197f9e8e85fb3846b6fcd682d854e5689  xsa504.patch
$

DEPLOYMENT DURING EMBARGO
=========================

Deployment of the patches above (or others which are substantially similar) is
permitted during the embargo, even on public-facing systems with untrusted
guest users and administrators.

But: Distribution of updated software is prohibited (except to other
members of the predisclosure list).

Predisclosure list members who wish to deploy significantly different
patches and/or mitigations, please contact the Xen Project Security
Team.

(Note: this during-embargo deployment notice is retained in
post-embargo publicly released Xen Project advisories, even though it
is then no longer applicable.  This is to enable the community to have
oversight of the Xen Project Security Team's decisionmaking.)

For more information about permissible uses of embargoed information,
consult the Xen Project community's agreed Security Policy:
  http://www.xenproject.org/security-policy.html
-----BEGIN PGP SIGNATURE-----

iQFABAEBCAAqFiEEI+MiLBRfRHX6gGCng/4UyVfoK9kFAmpomroMHHBncEB4ZW4u
b3JnAAoJEIP+FMlX6CvZiF4H+QFl08pzXWh5Zd2uOlbjYCaQMoDFeWSGCAkCcG8z
PlKv4yVLPwxUB0W5cPVV61M/fFDgihZh0usNZ/xm5aTt0uhPE31kXItsYRRLPpmg
zbV5OgUgIJxeAABML030lNjlAyLBpVculHAWbyFZdMh/xf0bQc1ty8U/xQDLU+IE
cohmtH8v6WvK2PxTA8nNj39EB9rUcz1gYInLh2QltW14di7+FUHGISxiIr/eNcUv
9d/at8ESSH1WNeSRSr+sbE0dMRxAQgoMa93GvU7sEvuZtdwOnnET8l1nVN/84kXM
sCMq6mjgVDUmSNOH2aBXxewimjp9DV0BLkmliqHrHDKer3s=
=intH
-----END PGP SIGNATURE-----
From b3fe7bd3bf6c2ac7324ea0b33ca6afc38d81f159 Mon Sep 17 00:00:00 2001
From: Roger Pau Monne <roger.pau@citrix.com>
Date: Fri, 10 Jul 2026 15:18:12 +0200
Subject: x86/viridian: ensure count is always set when starting a timer
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Otherwise in periodic mode a division by 0 would happen on the second call
to start_stimer() when using periodic mode.

Note that the HyperV specification states: "Writing the value zero to the
Count register will stop the counter, thereby disabling the timer,
independent of the setting of AutoEnable in the configuration register."
so a timer with a 0 count should never be in the enabled state.

This is XSA-504 / CVE-2026-62431.

Fixes: 26fba3c85571 ("viridian: add implementation of synthetic timers")
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
---
 xen/arch/x86/hvm/viridian/time.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/xen/arch/x86/hvm/viridian/time.c b/xen/arch/x86/hvm/viridian/time.c
index 9311858d63c0..15f629af0f39 100644
--- a/xen/arch/x86/hvm/viridian/time.c
+++ b/xen/arch/x86/hvm/viridian/time.c
@@ -155,6 +155,14 @@ static void start_stimer(struct viridian_stimer *vs)
         printk(XENLOG_G_INFO "%pv: VIRIDIAN STIMER%u: enabled\n", v,
                stimerx);
 
+    if ( !vs->count )
+    {
+        gprintk(XENLOG_ERR, "VIRIDIAN STIMER started with 0 count\n");
+        ASSERT_UNREACHABLE();
+        domain_crash(v->domain);
+        return;
+    }
+
     if ( vs->config.periodic )
     {
         /*
@@ -364,7 +372,7 @@ int viridian_time_wrmsr(struct vcpu *v, uint32_t idx, uint64_t val)
 
         vs->config.as_uint64 = val;
 
-        if ( !vs->config.sintx )
+        if ( !vs->config.sintx || !vs->count )
             vs->config.enable = 0;
 
         if ( vs->config.enable )
@@ -575,6 +583,9 @@ void viridian_time_load_vcpu_ctxt(
 
         vs->config.as_uint64 = ctxt->stimer_config_msr[i];
         vs->count = ctxt->stimer_count_msr[i];
+        if ( !vs->config.sintx || !vs->count )
+            /* Reject enabling with a zero sintx or count fields. */
+            vs->config.enable = 0;
     }
 }
 
-- 
2.53.0