CVE-2025-58148

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-58148", "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "state": "PUBLISHED", "assignerShortName": "XEN", "dateReserved": "2025-08-26T06:48:41.443Z", "datePublished": "2025-10-31T11:50:28.407Z", "dateUpdated": "2025-11-04T21:13:30.190Z"}, "containers": {"cna": {"title": "x86: Incorrect input sanitisation in Viridian hypercalls", "datePublic": "2025-10-21T11:59:00.000Z", "descriptions": [{"lang": "en", "value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nSome Viridian hypercalls can specify a mask of vCPU IDs as an input, in\none of three formats. Xen has boundary checking bugs with all three\nformats, which can cause out-of-bounds reads and writes while processing\nthe inputs.\n\n * CVE-2025-58147. Hypercalls using the HV_VP_SET Sparse format can\n cause vpmask_set() to write out of bounds when converting the bitmap\n to Xen's format.\n\n * CVE-2025-58148. Hypercalls using any input format can cause\n send_ipi() to read d->vcpu[] out-of-bounds, and operate on a wild\n vCPU pointer."}], "impacts": [{"descriptions": [{"lang": "en", "value": "A buggy or malicious guest can cause Denial of Service (DoS) affecting\nthe entire host, information leaks, or elevation of privilege."}]}], "affected": [{"defaultStatus": "unknown", "product": "Xen", "vendor": "Xen", "versions": [{"status": "unknown", "version": "consult Xen advisory XSA-475"}]}], "configurations": [{"lang": "en", "value": "Xen versions 4.15 and newer are vulnerable. Versions 4.14 and older are\nnot vulnerable.\n\nOnly x86 HVM guests which have Viridian enabled can leverage the\nvulnerability.\n\nWith the `xl` toolstack, this means any `viridian=` setting in the VM's\nconfiguration file.\n\nNote - despite:\n\n `viridian=[\"!hcall_remote_tlb_flush\", \"!hcall_ipi\", \"!ex_processor_masks\"]`\n\nbeing documented to turns off the relevant functionality, this\nconfiguration does not block the relevant hypercalls."}], "workarounds": [{"lang": "en", "value": "Not enabling Viridian will avoid the issuse."}], "credits": [{"lang": "en", "type": "finder", "value": "This issue was discovered by Teddy Astie of Vates"}], "references": [{"url": "https://xenbits.xenproject.org/xsa/advisory-475.html"}], "providerMetadata": {"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "shortName": "XEN", "dateUpdated": "2025-10-31T11:50:28.407Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-125", "lang": "en", "description": "CWE-125 Out-of-bounds Read"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-787", "lang": "en", "description": "CWE-787 Out-of-bounds Write"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-11-03T14:25:18.838278Z", "id": "CVE-2025-58148", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-03T14:25:21.434Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://xenbits.xen.org/xsa/advisory-475.html"}, {"url": "http://www.openwall.com/lists/oss-security/2025/10/21/1"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T21:13:30.190Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://xenbits.xen.org/xsa/advisory-475.html"}, {"url": "http://www.openwall.com/lists/oss-security/2025/10/21/1"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T21:13:30.190Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-58148", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-03T14:25:18.838278Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-31T17:46:50.319Z"}}], "cna": {"title": "x86: Incorrect input sanitisation in Viridian hypercalls", "credits": [{"lang": "en", "type": "finder", "value": "This issue was discovered by Teddy Astie of Vates"}], "impacts": [{"descriptions": [{"lang": "en", "value": "A buggy or malicious guest can cause Denial of Service (DoS) affecting\nthe entire host, information leaks, or elevation of privilege."}]}], "affected": [{"vendor": "Xen", "product": "Xen", "versions": [{"status": "unknown", "version": "consult Xen advisory XSA-475"}], "defaultStatus": "unknown"}], "datePublic": "2025-10-21T11:59:00.000Z", "references": [{"url": "https://xenbits.xenproject.org/xsa/advisory-475.html"}], "workarounds": [{"lang": "en", "value": "Not enabling Viridian will avoid the issuse."}], "descriptions": [{"lang": "en", "value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nSome Viridian hypercalls can specify a mask of vCPU IDs as an input, in\none of three formats. Xen has boundary checking bugs with all three\nformats, which can cause out-of-bounds reads and writes while processing\nthe inputs.\n\n * CVE-2025-58147. Hypercalls using the HV_VP_SET Sparse format can\n cause vpmask_set() to write out of bounds when converting the bitmap\n to Xen's format.\n\n * CVE-2025-58148. Hypercalls using any input format can cause\n send_ipi() to read d->vcpu[] out-of-bounds, and operate on a wild\n vCPU pointer."}], "configurations": [{"lang": "en", "value": "Xen versions 4.15 and newer are vulnerable. Versions 4.14 and older are\nnot vulnerable.\n\nOnly x86 HVM guests which have Viridian enabled can leverage the\nvulnerability.\n\nWith the `xl` toolstack, this means any `viridian=` setting in the VM's\nconfiguration file.\n\nNote - despite:\n\n `viridian=[\"!hcall_remote_tlb_flush\", \"!hcall_ipi\", \"!ex_processor_masks\"]`\n\nbeing documented to turns off the relevant functionality, this\nconfiguration does not block the relevant hypercalls."}], "providerMetadata": {"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "shortName": "XEN", "dateUpdated": "2025-10-31T11:50:28.407Z"}}}, "cveMetadata": {"cveId": "CVE-2025-58148", "state": "PUBLISHED", "dateUpdated": "2025-11-04T21:13:30.190Z", "dateReserved": "2025-08-26T06:48:41.443Z", "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "datePublished": "2025-10-31T11:50:28.407Z", "assignerShortName": "XEN"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Xen", "vendor": "Xen", "versions": [{"status": "unknown", "version": "consult Xen advisory XSA-475"}]}], "source": "security@xen.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*", "matchCriteriaId": "E77C52A9-C85D-4198-B397-2F7BF859CBE7", "versionStartIncluding": "4.15.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nSome Viridian hypercalls can specify a mask of vCPU IDs as an input, in\none of three formats. Xen has boundary checking bugs with all three\nformats, which can cause out-of-bounds reads and writes while processing\nthe inputs.\n\n * CVE-2025-58147. Hypercalls using the HV_VP_SET Sparse format can\n cause vpmask_set() to write out of bounds when converting the bitmap\n to Xen's format.\n\n * CVE-2025-58148. Hypercalls using any input format can cause\n send_ipi() to read d->vcpu[] out-of-bounds, and operate on a wild\n vCPU pointer."}, {"lang": "es", "value": "Este registro de informaci\u00f3n de CNA se relaciona con m\u00faltiples CVEs; el texto explica qu\u00e9 aspectos/vulnerabilidades corresponden a qu\u00e9 CVE.\n\nAlgunas hiperllamadas de Viridian pueden especificar una m\u00e1scara de IDs de vCPU como entrada, en uno de tres formatos. Xen tiene errores de comprobaci\u00f3n de l\u00edmites con los tres formatos, lo que puede causar lecturas y escrituras fuera de l\u00edmites mientras procesa las entradas.\n\n* CVE-2025-58147. Las hiperllamadas que utilizan el formato HV_VP_SET Sparse pueden hacer que vpmask_set() escriba fuera de l\u00edmites al convertir el mapa de bits al formato de Xen.\n\n* CVE-2025-58148. Las hiperllamadas que utilizan cualquier formato de entrada pueden hacer que send_ipi() lea d -> vcpu[] fuera de l\u00edmites, y opere sobre un puntero vCPU no v\u00e1lido."}], "id": "CVE-2025-58148", "lastModified": "2026-10-19T13:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-58148", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-03T14:25:18.838278Z", "version": "2.0.3"}}]}, "published": "2025-10-31T12:15:35.037", "references": [{"source": "security@xen.org", "tags": ["Patch", "Vendor Advisory"], "url": "https://xenbits.xenproject.org/xsa/advisory-475.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2025/10/21/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://xenbits.xen.org/xsa/advisory-475.html"}], "sourceIdentifier": "security@xen.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-787"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"created": "2025-11-03T10:43:53.379034+00:00", "updated": "2025-11-03T10:43:53.379069+00:00", "vendors": ["xen", "xen$PRODUCT$xen"]}