CVE-2025-8860: Qemu-kvm: uefi-vars: information disclosure vulnerability in uefi_vars_write callback
A flaw was found in QEMU in the uefi-vars virtual device. When the guest writes to register UEFIVARSREGBUFFERSIZE, the .write callback uefivarswrite is invoked. The function allocates a heap buffer without zeroing the memory, leaving the buffer filled with residual data from prior allocations. When the guest later reads from register UEFIVARSREGPIOBUFFERTRANSFER, the .read callback uefivarsread returns leftover metadata or other sensitive process memory from the previously allocated buffer, leading to an information disclosure vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-8860?
CVE-2025-8860 is considered a medium severity vulnerability due to the potential information leakage associated with uninitialized memory.
How do I fix CVE-2025-8860?
To fix CVE-2025-8860, you should update to the latest version of QEMU that includes the patch addressing this vulnerability.
What versions of QEMU are affected by CVE-2025-8860?
CVE-2025-8860 affects various versions of QEMU prior to the implementation of the appropriate fix in subsequent releases.
What types of attacks can exploit CVE-2025-8860?
CVE-2025-8860 can be exploited to read sensitive data from uninitialized memory, which may lead to information disclosure.
Is CVE-2025-8860 a local or remote vulnerability?
CVE-2025-8860 is primarily a local vulnerability that requires an attacker to have access to the guest environment to exploit.