Description
The pyGrub boot loader in Xen 3.0.3, 3.3.0, and Xen-3.3.1 does not support the password option in grub.conf for para-virtualized guests, which allows attackers with access to the para-virtualized guest console to boot the guest or modify the guest's kernel boot parameters without providing the expected password.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | xen +1 | 3.0.3-94.el5_4.1 | RHSA-2009:1472 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Virtualization 5 | xen +1 | 3.0.3-94.el5_4.1 | RHSA-2009:1472 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Xen 3.x - pygrub Local Authentication Bypass EDB-33255 · local · Sep 25, 2009 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- RHSA-2009:1472 Red Hat Security Advisory: xen security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- oval:org.mitre.oval:def:9466 vdb-entry signature
- [oss-security] 20090925 CVE Request -- Xen -- PyGrub mailing-list
- 36908 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=525740#c0
- RHSA-2009:1472 vendor-advisory
- SUSE-SR:2010:012 vendor-advisory
- 36523 vdb-entry
- 1022950 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=525740
- http://xenbits.xensource.com/xen-unstable.hg?rev/8f783adc0ee3