CVE-2025-27465

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-27465", "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "state": "PUBLISHED", "assignerShortName": "XEN", "dateReserved": "2025-02-26T09:16:54.461Z", "datePublished": "2025-07-16T09:08:39.931Z", "dateUpdated": "2025-11-04T21:09:50.127Z"}, "containers": {"cna": {"title": "x86: Incorrect stubs exception handling for flags recovery", "datePublic": "2025-07-01T11:56:00.000Z", "descriptions": [{"lang": "en", "value": "Certain instructions need intercepting and emulating by Xen. In some\ncases Xen emulates the instruction by replaying it, using an executable\nstub. Some instructions may raise an exception, which is supposed to be\nhandled gracefully. Certain replayed instructions have additional logic\nto set up and recover the changes to the arithmetic flags.\n\nFor replayed instructions where the flags recovery logic is used, the\nmetadata for exception handling was incorrect, preventing Xen from\nhandling the the exception gracefully, treating it as fatal instead."}], "impacts": [{"descriptions": [{"lang": "en", "value": "An unprivileged guest can cause a hypervisor crash, causing a Denial of\nService (DoS) of the entire host."}]}], "affected": [{"defaultStatus": "unknown", "product": "Xen", "vendor": "Xen", "versions": [{"status": "unknown", "version": "consult Xen advisory XSA-470"}]}], "configurations": [{"lang": "en", "value": "Xen 4.9 and onwards are vulnerable. Xen 4.8 and older are not\nvulnerable.\n\nOnly x86 systems are vulnerable. ARM systems are not vulnerable.\n\nOnly HVM or PVH guests can leverage the vulnerability. PV guests cannot\nleverage the vulnerability."}], "workarounds": [{"lang": "en", "value": "There are no mitigations."}], "credits": [{"lang": "en", "type": "finder", "value": "This issue was discovered by Andrew Cooper of XenServer."}], "references": [{"url": "https://xenbits.xenproject.org/xsa/advisory-470.html"}], "providerMetadata": {"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "shortName": "XEN", "dateUpdated": "2025-07-16T09:08:39.931Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-755", "lang": "en", "description": "CWE-755 Improper Handling of Exceptional Conditions"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-07-16T20:46:06.289437Z", "id": "CVE-2025-27465", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-17T15:00:57.741Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://xenbits.xen.org/xsa/advisory-470.html"}, {"url": "http://www.openwall.com/lists/oss-security/2025/07/01/1"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T21:09:50.127Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://xenbits.xen.org/xsa/advisory-470.html"}, {"url": "http://www.openwall.com/lists/oss-security/2025/07/01/1"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T21:09:50.127Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-27465", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-16T20:46:06.289437Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-755", "description": "CWE-755 Improper Handling of Exceptional Conditions"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-16T20:46:28.330Z"}}], "cna": {"title": "x86: Incorrect stubs exception handling for flags recovery", "credits": [{"lang": "en", "type": "finder", "value": "This issue was discovered by Andrew Cooper of XenServer."}], "impacts": [{"descriptions": [{"lang": "en", "value": "An unprivileged guest can cause a hypervisor crash, causing a Denial of\nService (DoS) of the entire host."}]}], "affected": [{"vendor": "Xen", "product": "Xen", "versions": [{"status": "unknown", "version": "consult Xen advisory XSA-470"}], "defaultStatus": "unknown"}], "datePublic": "2025-07-01T11:56:00.000Z", "references": [{"url": "https://xenbits.xenproject.org/xsa/advisory-470.html"}], "workarounds": [{"lang": "en", "value": "There are no mitigations."}], "descriptions": [{"lang": "en", "value": "Certain instructions need intercepting and emulating by Xen. In some\ncases Xen emulates the instruction by replaying it, using an executable\nstub. Some instructions may raise an exception, which is supposed to be\nhandled gracefully. Certain replayed instructions have additional logic\nto set up and recover the changes to the arithmetic flags.\n\nFor replayed instructions where the flags recovery logic is used, the\nmetadata for exception handling was incorrect, preventing Xen from\nhandling the the exception gracefully, treating it as fatal instead."}], "configurations": [{"lang": "en", "value": "Xen 4.9 and onwards are vulnerable. Xen 4.8 and older are not\nvulnerable.\n\nOnly x86 systems are vulnerable. ARM systems are not vulnerable.\n\nOnly HVM or PVH guests can leverage the vulnerability. PV guests cannot\nleverage the vulnerability."}], "providerMetadata": {"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "shortName": "XEN", "dateUpdated": "2025-07-16T09:08:39.931Z"}}}, "cveMetadata": {"cveId": "CVE-2025-27465", "state": "PUBLISHED", "dateUpdated": "2025-11-04T21:09:50.127Z", "dateReserved": "2025-02-26T09:16:54.461Z", "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "datePublished": "2025-07-16T09:08:39.931Z", "assignerShortName": "XEN"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Xen", "vendor": "Xen", "versions": [{"status": "unknown", "version": "consult Xen advisory XSA-470"}]}], "source": "security@xen.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:xen:xen:*:*:*:*:*:*:x86:*", "matchCriteriaId": "6730EA5A-AAE6-4C6F-963C-EBE9E4AA4D48", "versionStartIncluding": "4.9.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Certain instructions need intercepting and emulating by Xen. In some\ncases Xen emulates the instruction by replaying it, using an executable\nstub. Some instructions may raise an exception, which is supposed to be\nhandled gracefully. Certain replayed instructions have additional logic\nto set up and recover the changes to the arithmetic flags.\n\nFor replayed instructions where the flags recovery logic is used, the\nmetadata for exception handling was incorrect, preventing Xen from\nhandling the the exception gracefully, treating it as fatal instead."}, {"lang": "es", "value": "Ciertas instrucciones requieren ser interceptadas y emuladas por Xen. En algunos casos, Xen emula la instrucci\u00f3n repiti\u00e9ndola mediante un stub ejecutable. Algunas instrucciones pueden generar una excepci\u00f3n, que deber\u00eda gestionarse correctamente. Algunas instrucciones repetidas tienen l\u00f3gica adicional para configurar y recuperar los cambios en las banderas aritm\u00e9ticas. En las instrucciones repetidas donde se utiliza la l\u00f3gica de recuperaci\u00f3n de banderas, los metadatos para la gesti\u00f3n de excepciones eran incorrectos, lo que impidi\u00f3 que Xen la gestionara correctamente, trat\u00e1ndola como fatal."}], "id": "CVE-2025-27465", "lastModified": "2026-06-17T09:03:38.197", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-27465", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-07-16T20:46:06.289437Z", "version": "2.0.3"}}]}, "published": "2025-07-16T09:15:23.040", "references": [{"source": "security@xen.org", "tags": ["Patch", "Vendor Advisory"], "url": "https://xenbits.xenproject.org/xsa/advisory-470.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2025/07/01/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://xenbits.xen.org/xsa/advisory-470.html"}], "sourceIdentifier": "security@xen.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-755"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"created": "2025-07-21T15:17:35.031943+00:00", "updated": "2025-07-21T15:17:35.032015+00:00", "vendors": ["xen", "xen$PRODUCT$xen"]}