CVE-2025-58147CWE-125

CVE-2025-58147

High · published October 31, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
30.8
In the wild
Unconfirmed
What it is

⚡ A mask of vCPU IDs can turn into a wild ride! Certain hypercalls in Viridian can lead to out-of-bounds reads and writes, causing some serious ruckus in Xen's processing. 🔥 Think of this like a restaurant's ordering system where the chef mistakenly cooks the wrong number of dishes because the order tickets were misprinted. If the chef doesn't review the tickets correctly, they might end up serving too many or too few dishes, leading to chaos in the kitchen. The consequences could be quite severe: an attacker could exploit this vulnerability to manipulate memory, which could lead to system crashes or unexpected behavior. In the worst-case scenario, it could even allow for unauthorized access to sensitive data or control over system resources.

Put simply

Think of this like a restaurant's ordering system where the chef mistakenly cooks the wrong number of dishes because the order tickets were misprinted. If the chef doesn't review the tickets correctly, they might end up serving too many or too few dishes, leading to chaos in the kitchen. This vulnerability arises from boundary checking bugs in Xen when processing hypercalls in the HV_VP_SET Sparse format, allowing for out-of-bounds writes in the function vpmask_set(). It can also lead to out-of-bounds reads when using send_ipi() with any input format.

What to do

The consequences could be quite severe: an attacker could exploit this vulnerability to manipulate memory, which could lead to system crashes or unexpected behavior. In the worst-case scenario, it could even allow for unauthorized access to sensitive data or control over system resources. To mitigate this, ensure you apply the latest patches from Xen that address these out-of-bounds issues. Review your system's hypercall configurations and consider disabling the affected formats if not in use. Regularly monitor for updates as the situation evolves. You've got this! Stay proactive, patch up, and keep your systems safe and sound! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00380 · 30.8th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2025-10-31T16:15Z
Affected products (1)
ProductVersionsFixed in
xen/xen≥ 4.15.0—
References (3)
EPSS history
Timeline
  • 31 OCT 11:50Z
    x86: Incorrect input sanitisation in Viridian hypercalls
    cvelistv5