CVE-2025-58148: x86: Incorrect input sanitisation in Viridian hypercalls
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]
Some Viridian hypercalls can specify a mask of vCPU IDs as an input, in one of three formats. Xen has boundary checking bugs with all three formats, which can cause out-of-bounds reads and writes while processing the inputs.
CVE-2025-58147. Hypercalls using the HVVPSET Sparse format can cause vpmaskset() to write out of bounds when converting the bitmap to Xen's format.
CVE-2025-58148. Hypercalls using any input format can cause sendipi() to read d->vcpu[] out-of-bounds, and operate on a wild vCPU pointer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/xento a version that resolves this vulnerability.Fixed in 4.17.5+72-g01140da4e8-1Fixed in 4.17.7+13-g2445b30a44-0+deb12u1Fixed in 4.20.3+127-gc42374a105-0+deb13u1Fixed in 4.20.4+63-g7abfd2bce2-0+deb13u1Fixed in 4.20.4+39-gf1e1321c87-1Fixed in 4.20.4+63-g7abfd2bce2-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-58148?
CVE-2025-58148 has been classified with a severity rating that indicates a moderate risk to affected systems.
What systems are affected by CVE-2025-58148?
CVE-2025-58148 affects various versions of the Xen hypervisor.
How do I fix CVE-2025-58148?
To fix CVE-2025-58148, update your Xen hypervisor to the latest patched version provided by the vendor.
What types of vulnerabilities are associated with CVE-2025-58148?
CVE-2025-58148 is associated with boundary checking bugs in hypercalls that can affect vCPU ID masking.
Is there a workaround for CVE-2025-58148?
Currently, there are no officially documented workarounds for CVE-2025-58148, so applying patches is recommended.