CVE-2025-58148: x86: Incorrect input sanitisation in Viridian hypercalls
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]
Some Viridian hypercalls can specify a mask of vCPU IDs as an input, in one of three formats. Xen has boundary checking bugs with all three formats, which can cause out-of-bounds reads and writes while processing the inputs.
CVE-2025-58147. Hypercalls using the HVVPSET Sparse format can cause vpmaskset() to write out of bounds when converting the bitmap to Xen's format.
CVE-2025-58148. Hypercalls using any input format can cause sendipi() to read d->vcpu[] out-of-bounds, and operate on a wild vCPU pointer.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-58148?
CVE-2025-58148 has been classified with a severity rating that indicates a moderate risk to affected systems.
What systems are affected by CVE-2025-58148?
CVE-2025-58148 affects various versions of the Xen hypervisor.
How do I fix CVE-2025-58148?
To fix CVE-2025-58148, update your Xen hypervisor to the latest patched version provided by the vendor.
What types of vulnerabilities are associated with CVE-2025-58148?
CVE-2025-58148 is associated with boundary checking bugs in hypercalls that can affect vCPU ID masking.
Is there a workaround for CVE-2025-58148?
Currently, there are no officially documented workarounds for CVE-2025-58148, so applying patches is recommended.