Qubes OS Research on iasds

QSB-116: Xen Vulnerabilities (XSA-500/505/506/507) — Research PoCs

Wed, 29 Jul 2026 00:00:00 +0000

On 2026-07-28, the Qubes Security Team published QSB-116, covering four Xen vulnerabilities disclosed the same day:

XSA	CVE	Title	Xen Versions Affected	Default Qubes Config
XSA-500	CVE-2026-62428	grant-table: type confusion in grant-copy	≥ 4.2	Affected
XSA-505	CVE-2026-62432	evtchn: Race between FIFO expand and reset	≥ 4.5	Stubdomains only (QEMU needed first)
XSA-506	CVE-2026-62433	correct buffer checks for DM_OP hypercalls	≥ 4.10	Untrusted HVM qubes
XSA-507	CVE-2026-62434	PoD: Don’t try to reclaim special pages	≥ 3.4	Affected with relevant memory-balancing configuration

These are research PoCs using privcmd ioctls and Xen headers, without a libxenctrl dependency. A successful build or a timeout is not evidence that a vulnerability was triggered; record the Xen version, guest configuration, return code, and Xen log for every run.

Build Security Doesn't Need Full Determinism — A Practical Multi-Sig + Transparency Log Approach

Thu, 11 Jun 2026 00:00:00 +0000

Qubes’ current release signing flow relies on a single point of trust — one person holds the release key. It’s worked for over a decade, but “hasn’t been compromised yet” isn’t the same as “can’t be compromised.”

Everyone agrees deterministic builds + multi-signature is the right direction. Issue #816 has been open for years, which shows the community knows its value. But full determinism is a heavy lift — getting thousands of packages across dozens of upstream projects to produce bit-identical output is a massive undertaking.

Clash Gateway — Transparent Proxy Guide

Fri, 15 May 2026 00:00:00 +0000

Intro

This guide explains how to set up a transparent proxy gateway on Qubes OS using qubes-clash-gateway, powered by mihomo (formerly Clash Meta).

Unlike per-AppVM proxy configurations, this approach turns a single NetVM into a proxy gateway. All downstream AppVMs get proxied automatically with zero configuration — just set the NetVM and go.

What it does:

Transparent proxy for all TCP/UDP traffic
DNS fake-ip to prevent DNS pollution
GeoIP rule-based routing (CN direct, foreign proxy)
Subscription parser supporting Clash YAML, vmess/vless/ss/ssr/trojan/hy2/tuic/wireguard
Terminal controller clashctl + Web UI for management

How it works: