CVE-2025-58148

{"id": "CVE-2025-58148", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-58148", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-03T14:25:18.838278Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@xen.org", "affectedData": [{"vendor": "Xen", "product": "Xen", "versions": [{"status": "unknown", "version": "consult Xen advisory XSA-475"}], "defaultStatus": "unknown"}]}], "published": "2025-10-31T12:15:35.037", "references": [{"url": "https://xenbits.xenproject.org/xsa/advisory-475.html", "tags": ["Patch", "Vendor Advisory"], "source": "security@xen.org"}, {"url": "http://www.openwall.com/lists/oss-security/2025/10/21/1", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://xenbits.xen.org/xsa/advisory-475.html", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nSome Viridian hypercalls can specify a mask of vCPU IDs as an input, in\none of three formats. Xen has boundary checking bugs with all three\nformats, which can cause out-of-bounds reads and writes while processing\nthe inputs.\n\n * CVE-2025-58147. Hypercalls using the HV_VP_SET Sparse format can\n cause vpmask_set() to write out of bounds when converting the bitmap\n to Xen's format.\n\n * CVE-2025-58148. Hypercalls using any input format can cause\n send_ipi() to read d->vcpu[] out-of-bounds, and operate on a wild\n vCPU pointer."}, {"lang": "es", "value": "Este registro de informaci\u00f3n de CNA se relaciona con m\u00faltiples CVEs; el texto explica qu\u00e9 aspectos/vulnerabilidades corresponden a qu\u00e9 CVE.\n\nAlgunas hiperllamadas de Viridian pueden especificar una m\u00e1scara de IDs de vCPU como entrada, en uno de tres formatos. Xen tiene errores de comprobaci\u00f3n de l\u00edmites con los tres formatos, lo que puede causar lecturas y escrituras fuera de l\u00edmites mientras procesa las entradas.\n\n* CVE-2025-58147. Las hiperllamadas que utilizan el formato HV_VP_SET Sparse pueden hacer que vpmask_set() escriba fuera de l\u00edmites al convertir el mapa de bits al formato de Xen.\n\n* CVE-2025-58148. Las hiperllamadas que utilizan cualquier formato de entrada pueden hacer que send_ipi() lea d -> vcpu[] fuera de l\u00edmites, y opere sobre un puntero vCPU no v\u00e1lido."}], "lastModified": "2026-10-19T13:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E77C52A9-C85D-4198-B397-2F7BF859CBE7", "versionStartIncluding": "4.15.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@xen.org"}