CVE-2025-58147: x86: Incorrect input sanitisation in Viridian hypercalls
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]
Some Viridian hypercalls can specify a mask of vCPU IDs as an input, in one of three formats. Xen has boundary checking bugs with all three formats, which can cause out-of-bounds reads and writes while processing the inputs.
CVE-2025-58147. Hypercalls using the HVVPSET Sparse format can cause vpmaskset() to write out of bounds when converting the bitmap to Xen's format.
CVE-2025-58148. Hypercalls using any input format can cause sendipi() to read d->vcpu[] out-of-bounds, and operate on a wild vCPU pointer.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-58147?
The severity of CVE-2025-58147 is currently rated as high due to its potential impact on hypercall processing in Xen.
How do I fix CVE-2025-58147?
To fix CVE-2025-58147, users should apply the latest patches provided by the Xen Project as outlined in the relevant advisory.
What are the affected versions of Xen for CVE-2025-58147?
CVE-2025-58147 affects multiple versions of Xen, particularly those that utilize Viridian hypercalls.
What is the impact of CVE-2025-58147?
The impact of CVE-2025-58147 can lead to improper input validation that might allow privilege escalation and denial of service.
Are there any workarounds for CVE-2025-58147?
Currently, there are no recommended workarounds for CVE-2025-58147; the only solution is to apply the security patches.