GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-58148 (GCVE-0-2025-58148)

Vulnerability from cvelistv5 – Published: 2025-10-31 11:50 – Updated: 2025-11-04 21:13
VLAI
Title
x86: Incorrect input sanitisation in Viridian hypercalls
Summary
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Some Viridian hypercalls can specify a mask of vCPU IDs as an input, in one of three formats. Xen has boundary checking bugs with all three formats, which can cause out-of-bounds reads and writes while processing the inputs. * CVE-2025-58147. Hypercalls using the HV_VP_SET Sparse format can cause vpmask_set() to write out of bounds when converting the bitmap to Xen's format. * CVE-2025-58148. Hypercalls using any input format can cause send_ipi() to read d->vcpu[] out-of-bounds, and operate on a wild vCPU pointer.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-11-03 14:25 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Xen Xen Unknown: consult Xen advisory XSA-475
guessed Create a notification for this product.
Date Public
2025-10-21 11:59
Credits
This issue was discovered by Teddy Astie of Vates
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-58148",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-03T14:25:18.838278Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-125",
                "description": "CWE-125 Out-of-bounds Read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          },
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-11-03T14:25:21.434Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T21:13:30.190Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://xenbits.xen.org/xsa/advisory-475.html"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/10/21/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Xen",
          "vendor": "Xen",
          "versions": [
            {
              "status": "unknown",
              "version": "consult Xen advisory XSA-475"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "Xen versions 4.15 and newer are vulnerable.  Versions 4.14 and older are\nnot vulnerable.\n\nOnly x86 HVM guests which have Viridian enabled can leverage the\nvulnerability.\n\nWith the `xl` toolstack, this means any `viridian=` setting in the VM\u0027s\nconfiguration file.\n\nNote - despite:\n\n  `viridian=[\"!hcall_remote_tlb_flush\", \"!hcall_ipi\", \"!ex_processor_masks\"]`\n\nbeing documented to turns off the relevant functionality, this\nconfiguration does not block the relevant hypercalls."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This issue was discovered by Teddy Astie of Vates"
        }
      ],
      "datePublic": "2025-10-21T11:59:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nSome Viridian hypercalls can specify a mask of vCPU IDs as an input, in\none of three formats.  Xen has boundary checking bugs with all three\nformats, which can cause out-of-bounds reads and writes while processing\nthe inputs.\n\n * CVE-2025-58147.  Hypercalls using the HV_VP_SET Sparse format can\n   cause vpmask_set() to write out of bounds when converting the bitmap\n   to Xen\u0027s format.\n\n * CVE-2025-58148.  Hypercalls using any input format can cause\n   send_ipi() to read d-\u003evcpu[] out-of-bounds, and operate on a wild\n   vCPU pointer."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "A buggy or malicious guest can cause Denial of Service (DoS) affecting\nthe entire host, information leaks, or elevation of privilege."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-31T11:50:28.407Z",
        "orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
        "shortName": "XEN"
      },
      "references": [
        {
          "url": "https://xenbits.xenproject.org/xsa/advisory-475.html"
        }
      ],
      "title": "x86: Incorrect input sanitisation in Viridian hypercalls",
      "workarounds": [
        {
          "lang": "en",
          "value": "Not enabling Viridian will avoid the issuse."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
    "assignerShortName": "XEN",
    "cveId": "CVE-2025-58148",
    "datePublished": "2025-10-31T11:50:28.407Z",
    "dateReserved": "2025-08-26T06:48:41.443Z",
    "dateUpdated": "2025-11-04T21:13:30.190Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-58148",
      "date": "2026-09-16",
      "epss": "0.00355",
      "percentile": "0.29016"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-58148\",\"sourceIdentifier\":\"security@xen.org\",\"published\":\"2025-10-31T12:15:35.037\",\"lastModified\":\"2026-06-17T09:43:58.893\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"[This CNA information record relates to multiple CVEs; the\\ntext explains which aspects/vulnerabilities correspond to which CVE.]\\n\\nSome Viridian hypercalls can specify a mask of vCPU IDs as an input, in\\none of three formats.  Xen has boundary checking bugs with all three\\nformats, which can cause out-of-bounds reads and writes while processing\\nthe inputs.\\n\\n * CVE-2025-58147.  Hypercalls using the HV_VP_SET Sparse format can\\n   cause vpmask_set() to write out of bounds when converting the bitmap\\n   to Xen\u0027s format.\\n\\n * CVE-2025-58148.  Hypercalls using any input format can cause\\n   send_ipi() to read d-\u003evcpu[] out-of-bounds, and operate on a wild\\n   vCPU pointer.\"}],\"affected\":[{\"source\":\"security@xen.org\",\"affectedData\":[{\"vendor\":\"Xen\",\"product\":\"Xen\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"consult Xen advisory XSA-475\",\"status\":\"unknown\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-11-03T14:25:18.838278Z\",\"id\":\"CVE-2025-58148\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"},{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15.0\",\"matchCriteriaId\":\"E77C52A9-C85D-4198-B397-2F7BF859CBE7\"}]}]}],\"references\":[{\"url\":\"https://xenbits.xenproject.org/xsa/advisory-475.html\",\"source\":\"security@xen.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2025/10/21/1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"http://xenbits.xen.org/xsa/advisory-475.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2026-06-28T11:22:07+00:00",
      "cve": "CVE-2025-58148",
      "id": "CVE-2025-58148",
      "initial_release_date": "2025-10-31T11:50:28.407000+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "xen: x86: Incorrect input sanitisation in Viridian hypercalls",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-58148.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-28T16:51:47Z",
      "cve": "CVE-2025-58148",
      "id": "CVE-2025-58148",
      "initial_release_date": "2025-10-21T23:25:34Z",
      "product_status:known_not_affected": "184",
      "product_status:recommended": "129",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-58148",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-58148.json",
      "version": "17"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://xenbits.xen.org/xsa/advisory-475.html\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2025/10/21/1\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-04T21:13:30.190Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-58148\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-11-03T14:25:18.838278Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-125\", \"description\": \"CWE-125 Out-of-bounds Read\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-787\", \"description\": \"CWE-787 Out-of-bounds Write\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-31T17:46:50.319Z\"}}], \"cna\": {\"title\": \"x86: Incorrect input sanitisation in Viridian hypercalls\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"This issue was discovered by Teddy Astie of Vates\"}], \"impacts\": [{\"descriptions\": [{\"lang\": \"en\", \"value\": \"A buggy or malicious guest can cause Denial of Service (DoS) affecting\\nthe entire host, information leaks, or elevation of privilege.\"}]}], \"affected\": [{\"vendor\": \"Xen\", \"product\": \"Xen\", \"versions\": [{\"status\": \"unknown\", \"version\": \"consult Xen advisory XSA-475\"}], \"defaultStatus\": \"unknown\"}], \"datePublic\": \"2025-10-21T11:59:00.000Z\", \"references\": [{\"url\": \"https://xenbits.xenproject.org/xsa/advisory-475.html\"}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Not enabling Viridian will avoid the issuse.\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"[This CNA information record relates to multiple CVEs; the\\ntext explains which aspects/vulnerabilities correspond to which CVE.]\\n\\nSome Viridian hypercalls can specify a mask of vCPU IDs as an input, in\\none of three formats.  Xen has boundary checking bugs with all three\\nformats, which can cause out-of-bounds reads and writes while processing\\nthe inputs.\\n\\n * CVE-2025-58147.  Hypercalls using the HV_VP_SET Sparse format can\\n   cause vpmask_set() to write out of bounds when converting the bitmap\\n   to Xen\u0027s format.\\n\\n * CVE-2025-58148.  Hypercalls using any input format can cause\\n   send_ipi() to read d-\u003evcpu[] out-of-bounds, and operate on a wild\\n   vCPU pointer.\"}], \"configurations\": [{\"lang\": \"en\", \"value\": \"Xen versions 4.15 and newer are vulnerable.  Versions 4.14 and older are\\nnot vulnerable.\\n\\nOnly x86 HVM guests which have Viridian enabled can leverage the\\nvulnerability.\\n\\nWith the `xl` toolstack, this means any `viridian=` setting in the VM\u0027s\\nconfiguration file.\\n\\nNote - despite:\\n\\n  `viridian=[\\\"!hcall_remote_tlb_flush\\\", \\\"!hcall_ipi\\\", \\\"!ex_processor_masks\\\"]`\\n\\nbeing documented to turns off the relevant functionality, this\\nconfiguration does not block the relevant hypercalls.\"}], \"providerMetadata\": {\"orgId\": \"23aa2041-22e1-471f-9209-9b7396fa234f\", \"shortName\": \"XEN\", \"dateUpdated\": \"2025-10-31T11:50:28.407Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-58148\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-11-04T21:13:30.190Z\", \"dateReserved\": \"2025-08-26T06:48:41.443Z\", \"assignerOrgId\": \"23aa2041-22e1-471f-9209-9b7396fa234f\", \"datePublished\": \"2025-10-31T11:50:28.407Z\", \"assignerShortName\": \"XEN\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.