CVE-2025-27466

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-27466", "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "state": "PUBLISHED", "assignerShortName": "XEN", "dateReserved": "2025-02-26T09:16:54.462Z", "datePublished": "2025-09-11T14:05:29.525Z", "dateUpdated": "2025-11-04T21:09:51.419Z"}, "containers": {"cna": {"title": "Mutiple vulnerabilities in the Viridian interface", "datePublic": "2025-09-09T11:53:00.000Z", "descriptions": [{"lang": "en", "value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nThere are multiple issues related to the handling and accessing of guest\nmemory pages in the viridian code:\n\n 1. A NULL pointer dereference in the updating of the reference TSC area.\n This is CVE-2025-27466.\n\n 2. A NULL pointer dereference by assuming the SIM page is mapped when\n a synthetic timer message has to be delivered. This is\n CVE-2025-58142.\n\n 3. A race in the mapping of the reference TSC page, where a guest can\n get Xen to free a page while still present in the guest physical to\n machine (p2m) page tables. This is CVE-2025-58143."}], "impacts": [{"descriptions": [{"lang": "en", "value": "Denial of Service (DoS) affecting the entire host, information leaks, or\nelevation of privilege."}]}], "affected": [{"defaultStatus": "unknown", "product": "Xen", "vendor": "Xen", "versions": [{"status": "unknown", "version": "consult Xen advisory XSA-472"}]}], "configurations": [{"lang": "en", "value": "Xen versions 4.13 and newer are vulnerable. Xen versions 4.12 and older\nare not vulnerable.\n\nOnly x86 HVM guests which have the reference_tsc or stimer viridian\nextensions enabled are vulnerable."}], "workarounds": [{"lang": "en", "value": "Not enabling the reference_tsc and stimer viridian extensions will avoid\nthe issues."}], "credits": [{"lang": "en", "type": "finder", "value": "This issue was discovered by Roger Pau Monn\u00e9 of XenServer."}], "references": [{"url": "https://xenbits.xenproject.org/xsa/advisory-472.html"}], "providerMetadata": {"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "shortName": "XEN", "dateUpdated": "2025-09-11T14:05:29.525Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-395", "lang": "en", "description": "CWE-395 Use of NullPointerException Catch to Detect NULL Pointer Dereference"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-09-11T14:25:53.637084Z", "id": "CVE-2025-27466", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-11T14:40:33.401Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://xenbits.xen.org/xsa/advisory-472.html"}, {"url": "http://www.openwall.com/lists/oss-security/2025/09/09/1"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T21:09:51.419Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://xenbits.xen.org/xsa/advisory-472.html"}, {"url": "http://www.openwall.com/lists/oss-security/2025/09/09/1"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T21:09:51.419Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-27466", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-09-11T14:25:53.637084Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-395", "description": "CWE-395 Use of NullPointerException Catch to Detect NULL Pointer Dereference"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-11T14:26:20.300Z"}}], "cna": {"title": "Mutiple vulnerabilities in the Viridian interface", "credits": [{"lang": "en", "type": "finder", "value": "This issue was discovered by Roger Pau Monn\u00e9 of XenServer."}], "impacts": [{"descriptions": [{"lang": "en", "value": "Denial of Service (DoS) affecting the entire host, information leaks, or\nelevation of privilege."}]}], "affected": [{"vendor": "Xen", "product": "Xen", "versions": [{"status": "unknown", "version": "consult Xen advisory XSA-472"}], "defaultStatus": "unknown"}], "datePublic": "2025-09-09T11:53:00.000Z", "references": [{"url": "https://xenbits.xenproject.org/xsa/advisory-472.html"}], "workarounds": [{"lang": "en", "value": "Not enabling the reference_tsc and stimer viridian extensions will avoid\nthe issues."}], "descriptions": [{"lang": "en", "value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nThere are multiple issues related to the handling and accessing of guest\nmemory pages in the viridian code:\n\n 1. A NULL pointer dereference in the updating of the reference TSC area.\n This is CVE-2025-27466.\n\n 2. A NULL pointer dereference by assuming the SIM page is mapped when\n a synthetic timer message has to be delivered. This is\n CVE-2025-58142.\n\n 3. A race in the mapping of the reference TSC page, where a guest can\n get Xen to free a page while still present in the guest physical to\n machine (p2m) page tables. This is CVE-2025-58143."}], "configurations": [{"lang": "en", "value": "Xen versions 4.13 and newer are vulnerable. Xen versions 4.12 and older\nare not vulnerable.\n\nOnly x86 HVM guests which have the reference_tsc or stimer viridian\nextensions enabled are vulnerable."}], "providerMetadata": {"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "shortName": "XEN", "dateUpdated": "2025-09-11T14:05:29.525Z"}}}, "cveMetadata": {"cveId": "CVE-2025-27466", "state": "PUBLISHED", "dateUpdated": "2025-11-04T21:09:51.419Z", "dateReserved": "2025-02-26T09:16:54.462Z", "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "datePublished": "2025-09-11T14:05:29.525Z", "assignerShortName": "XEN"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Xen", "vendor": "Xen", "versions": [{"status": "unknown", "version": "consult Xen advisory XSA-472"}]}], "source": "security@xen.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:xen:xen:*:*:*:*:*:*:x86:*", "matchCriteriaId": "79DE0A8E-ACC5-420F-923D-E4FEAFBBB77A", "versionEndExcluding": "4.17.0", "versionStartIncluding": "4.13.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nThere are multiple issues related to the handling and accessing of guest\nmemory pages in the viridian code:\n\n 1. A NULL pointer dereference in the updating of the reference TSC area.\n This is CVE-2025-27466.\n\n 2. A NULL pointer dereference by assuming the SIM page is mapped when\n a synthetic timer message has to be delivered. This is\n CVE-2025-58142.\n\n 3. A race in the mapping of the reference TSC page, where a guest can\n get Xen to free a page while still present in the guest physical to\n machine (p2m) page tables. This is CVE-2025-58143."}, {"lang": "es", "value": "Este registro de informaci\u00f3n de la CNA se relaciona con m\u00faltiples CVE; el texto explica qu\u00e9 aspectos/vulnerabilidades corresponden a qu\u00e9 CVE.\n\nExisten m\u00faltiples problemas relacionados con el manejo y acceso de p\u00e1ginas de memoria de invitado en el c\u00f3digo viridian:\n\n 1. Una desreferencia de puntero NULL en la actualizaci\u00f3n del \u00e1rea TSC de referencia. Esto es CVE-2025-27466.\n\n 2. Una desreferencia de puntero NULL al asumir que la p\u00e1gina SIM est\u00e1 mapeada cuando se debe entregar un mensaje de temporizador sint\u00e9tico. Esto es CVE-2025-58142.\n\n 3. Una condici\u00f3n de carrera en el mapeo de la p\u00e1gina TSC de referencia, donde un invitado puede hacer que Xen libere una p\u00e1gina mientras a\u00fan est\u00e1 presente en las tablas de p\u00e1ginas de f\u00edsico a m\u00e1quina (p2m) del invitado. Esto es CVE-2025-58143."}], "id": "CVE-2025-27466", "lastModified": "2026-10-19T17:10:00.173", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-27466", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-09-11T14:25:53.637084Z", "version": "2.0.3"}}]}, "published": "2025-09-11T14:15:41.413", "references": [{"source": "security@xen.org", "tags": ["Vendor Advisory"], "url": "https://xenbits.xenproject.org/xsa/advisory-472.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2025/09/09/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://xenbits.xen.org/xsa/advisory-472.html"}], "sourceIdentifier": "security@xen.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-395"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"created": "2025-09-12T08:02:57.028166+00:00", "updated": "2025-09-12T08:02:57.028219+00:00", "vendors": ["xen", "xen$PRODUCT$xen"]}