CVE-2025-58151

varstored is a component of the Xapi toolstack handling UEFI Variables for a VM. It has a communication path with OVMF inside the VM involving mapping a buffer prepared by OVMF. Within varstored, there were insufficient compiler barriers, creating TOCTOU issues with data in the shared buffer. The exact vulnerable behaviour depends on the code generated by the compiler. In a build of varstored using default settings, the attacker can control an index used in a jump table.

CVSS

No CVSS.

References

Link	Resource
https://xenbits.xen.org/xsa/advisory-478.html
http://www.openwall.com/lists/oss-security/2026/01/27/2
http://xenbits.xen.org/xsa/advisory-478.html

Configurations

No configuration.

History

29 Sep 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) varstored es un componente de la pila de herramientas Xapi que gestiona las variables UEFI para una VM. Tiene una ruta de comunicación con OVMF dentro de la VM que implica el mapeo de un búfer preparado por OVMF. Dentro de varstored, había barreras de compilador insuficientes, creando problemas TOCTOU con los datos en el búfer compartido. El comportamiento vulnerable exacto depende del código generado por el compilador. En una compilación de varstored utilizando la configuración predeterminada, el atacante puede controlar un índice utilizado en una tabla de salto.

Information

Published : 2026-07-09 16:16

Updated : 2026-09-29 19:10

NVD link : CVE-2025-58151

Mitre link : CVE-2025-58151

CVE.ORG link : CVE-2025-58151

JSON object : View

Products Affected

No product.

CWE

CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

{"id": "CVE-2025-58151", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-58151", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-09T15:40:36.292177Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security@xen.org", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@xen.org", "affectedData": [{"vendor": "Xen", "product": "varstored", "versions": [{"status": "affected", "version": "all"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}]}], "published": "2026-07-09T16:16:33.817", "references": [{"url": "https://xenbits.xen.org/xsa/advisory-478.html", "source": "security@xen.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/01/27/2", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://xenbits.xen.org/xsa/advisory-478.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@xen.org", "description": [{"lang": "en", "value": "CWE-367"}]}], "descriptions": [{"lang": "en", "value": "varstored is a component of the Xapi toolstack handling UEFI Variables\nfor a VM. It has a communication path with OVMF inside the VM involving\nmapping a buffer prepared by OVMF.\n\nWithin varstored, there were insufficient compiler barriers, creating\nTOCTOU issues with data in the shared buffer.\n\nThe exact vulnerable behaviour depends on the code generated by the\ncompiler. In a build of varstored using default settings, the attacker\ncan control an index used in a jump table."}, {"lang": "es", "value": "varstored es un componente de la pila de herramientas Xapi que gestiona las variables UEFI para una VM. Tiene una ruta de comunicaci\u00f3n con OVMF dentro de la VM que implica el mapeo de un b\u00fafer preparado por OVMF.\n\nDentro de varstored, hab\u00eda barreras de compilador insuficientes, creando problemas TOCTOU con los datos en el b\u00fafer compartido.\n\nEl comportamiento vulnerable exacto depende del c\u00f3digo generado por el compilador. En una compilaci\u00f3n de varstored utilizando la configuraci\u00f3n predeterminada, el atacante puede controlar un \u00edndice utilizado en una tabla de salto."}], "lastModified": "2026-09-29T19:10:00.160", "sourceIdentifier": "security@xen.org"}