CVE-2025-58144

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-58144", "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "state": "PUBLISHED", "assignerShortName": "XEN", "dateReserved": "2025-08-26T06:48:41.443Z", "datePublished": "2025-09-11T14:05:36.284Z", "dateUpdated": "2025-11-04T21:13:26.232Z"}, "containers": {"cna": {"title": "Arm issues with page refcounting", "datePublic": "2025-09-09T11:53:00.000Z", "descriptions": [{"lang": "en", "value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nThere are two issues related to the mapping of pages belonging to other\ndomains: For one, an assertion is wrong there, where the case actually\nneeds handling. A NULL pointer de-reference could result on a release\nbuild. This is CVE-2025-58144.\n\nAnd then the P2M lock isn't held until a page reference was actually\nobtained (or the attempt to do so has failed). Otherwise the page can\nnot only change type, but even ownership in between, thus allowing\ndomain boundaries to be violated. This is CVE-2025-58145."}], "impacts": [{"descriptions": [{"lang": "en", "value": "An unprivileged guest can cause a hypervisor crash, causing a Denial of\nService (DoS) of the entire host. Privilege escalation and information\nleaks cannot be ruled out."}]}], "affected": [{"defaultStatus": "unknown", "product": "Xen", "vendor": "Xen", "versions": [{"status": "unknown", "version": "consult Xen advisory XSA-473"}]}], "configurations": [{"lang": "en", "value": "Xen versions 4.12 and onwards are vulnerable. Xen versions 4.11 and\nearlier are not vulnerable.\n\nOnly Arm systems are affected. x86 systems are not affected."}], "workarounds": [{"lang": "en", "value": "There is no known mitigation."}], "credits": [{"lang": "en", "type": "finder", "value": "This issue was discovered by Jan Beulich of SUSE."}], "references": [{"url": "https://xenbits.xenproject.org/xsa/advisory-473.html"}], "providerMetadata": {"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "shortName": "XEN", "dateUpdated": "2025-09-11T14:05:36.284Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-476", "lang": "en", "description": "CWE-476 NULL Pointer Dereference"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-09-11T14:18:50.824988Z", "id": "CVE-2025-58144", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-11T14:38:26.891Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://xenbits.xen.org/xsa/advisory-473.html"}, {"url": "http://www.openwall.com/lists/oss-security/2025/09/09/2"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T21:13:26.232Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://xenbits.xen.org/xsa/advisory-473.html"}, {"url": "http://www.openwall.com/lists/oss-security/2025/09/09/2"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T21:13:26.232Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-58144", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-11T14:18:50.824988Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-476", "description": "CWE-476 NULL Pointer Dereference"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-11T14:20:15.475Z"}}], "cna": {"title": "Arm issues with page refcounting", "credits": [{"lang": "en", "type": "finder", "value": "This issue was discovered by Jan Beulich of SUSE."}], "impacts": [{"descriptions": [{"lang": "en", "value": "An unprivileged guest can cause a hypervisor crash, causing a Denial of\nService (DoS) of the entire host. Privilege escalation and information\nleaks cannot be ruled out."}]}], "affected": [{"vendor": "Xen", "product": "Xen", "versions": [{"status": "unknown", "version": "consult Xen advisory XSA-473"}], "defaultStatus": "unknown"}], "datePublic": "2025-09-09T11:53:00.000Z", "references": [{"url": "https://xenbits.xenproject.org/xsa/advisory-473.html"}], "workarounds": [{"lang": "en", "value": "There is no known mitigation."}], "descriptions": [{"lang": "en", "value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nThere are two issues related to the mapping of pages belonging to other\ndomains: For one, an assertion is wrong there, where the case actually\nneeds handling. A NULL pointer de-reference could result on a release\nbuild. This is CVE-2025-58144.\n\nAnd then the P2M lock isn't held until a page reference was actually\nobtained (or the attempt to do so has failed). Otherwise the page can\nnot only change type, but even ownership in between, thus allowing\ndomain boundaries to be violated. This is CVE-2025-58145."}], "configurations": [{"lang": "en", "value": "Xen versions 4.12 and onwards are vulnerable. Xen versions 4.11 and\nearlier are not vulnerable.\n\nOnly Arm systems are affected. x86 systems are not affected."}], "providerMetadata": {"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "shortName": "XEN", "dateUpdated": "2025-09-11T14:05:36.284Z"}}}, "cveMetadata": {"cveId": "CVE-2025-58144", "state": "PUBLISHED", "dateUpdated": "2025-11-04T21:13:26.232Z", "dateReserved": "2025-08-26T06:48:41.443Z", "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "datePublished": "2025-09-11T14:05:36.284Z", "assignerShortName": "XEN"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Xen", "vendor": "Xen", "versions": [{"status": "unknown", "version": "consult Xen advisory XSA-473"}]}], "source": "security@xen.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:xen:xen:*:*:*:*:*:*:arm:*", "matchCriteriaId": "9D45F922-4078-49EF-AE0D-C1A8CBBA0F2E", "versionEndExcluding": "4.17.0", "versionStartIncluding": "4.12.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nThere are two issues related to the mapping of pages belonging to other\ndomains: For one, an assertion is wrong there, where the case actually\nneeds handling. A NULL pointer de-reference could result on a release\nbuild. This is CVE-2025-58144.\n\nAnd then the P2M lock isn't held until a page reference was actually\nobtained (or the attempt to do so has failed). Otherwise the page can\nnot only change type, but even ownership in between, thus allowing\ndomain boundaries to be violated. This is CVE-2025-58145."}, {"lang": "es", "value": "[Este registro de informaci\u00f3n de la CNA se relaciona con m\u00faltiples CVE; el texto explica qu\u00e9 aspectos/vulnerabilidades corresponden a qu\u00e9 CVE.]\n\nHay dos problemas relacionados con el mapeo de p\u00e1ginas pertenecientes a otros dominios: Por un lado, una aserci\u00f3n es incorrecta all\u00ed, donde el caso realmente requiere manejo. Una desreferencia de puntero NULL podr\u00eda resultar en una compilaci\u00f3n de lanzamiento. Esto es CVE-2025-58144.\n\nY luego el bloqueo P2M no se mantiene hasta que se obtuvo realmente una referencia de p\u00e1gina (o el intento de hacerlo ha fallado). De lo contrario, la p\u00e1gina no solo puede cambiar de tipo, sino incluso de propiedad entretanto, permitiendo as\u00ed que se violen los l\u00edmites del dominio. Esto es CVE-2025-58145."}], "id": "CVE-2025-58144", "lastModified": "2026-10-19T17:10:00.173", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-58144", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-11T14:18:50.824988Z", "version": "2.0.3"}}]}, "published": "2025-09-11T14:15:42.593", "references": [{"source": "security@xen.org", "tags": ["Vendor Advisory"], "url": "https://xenbits.xenproject.org/xsa/advisory-473.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2025/09/09/2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://xenbits.xen.org/xsa/advisory-473.html"}], "sourceIdentifier": "security@xen.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"created": "2025-09-12T08:02:57.988814+00:00", "updated": "2025-09-12T08:02:57.988876+00:00", "vendors": ["xen", "xen$PRODUCT$xen"]}