CVE-2025-27466

{
  "id": "CVE-2025-27466",
  "sourceIdentifier": "[email protected]",
  "published": "2025-09-11T14:15:41.413",
  "lastModified": "2026-10-19T17:10:00.173",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nThere are multiple issues related to the handling and accessing of guest\nmemory pages in the viridian code:\n\n 1. A NULL pointer dereference in the updating of the reference TSC area.\n    This is CVE-2025-27466.\n\n 2. A NULL pointer dereference by assuming the SIM page is mapped when\n    a synthetic timer message has to be delivered.  This is\n    CVE-2025-58142.\n\n 3. A race in the mapping of the reference TSC page, where a guest can\n    get Xen to free a page while still present in the guest physical to\n    machine (p2m) page tables.  This is CVE-2025-58143."
    },
    {
      "lang": "es",
      "value": "Este registro de información de la CNA se relaciona con múltiples CVE; el texto explica qué aspectos/vulnerabilidades corresponden a qué CVE.\n\nExisten múltiples problemas relacionados con el manejo y acceso de páginas de memoria de invitado en el código viridian:\n\n 1. Una desreferencia de puntero NULL en la actualización del área TSC de referencia. Esto es CVE-2025-27466.\n\n 2. Una desreferencia de puntero NULL al asumir que la página SIM está mapeada cuando se debe entregar un mensaje de temporizador sintético. Esto es CVE-2025-58142.\n\n 3. Una condición de carrera en el mapeo de la página TSC de referencia, donde un invitado puede hacer que Xen libere una página mientras aún está presente en las tablas de páginas de físico a máquina (p2m) del invitado. Esto es CVE-2025-58143."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Xen",
          "product": "Xen",
          "defaultStatus": "unknown",
          "versions": [
            {
              "version": "consult Xen advisory XSA-472",
              "status": "unknown"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-09-11T14:25:53.637084Z",
          "id": "CVE-2025-27466",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-395"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:xen:xen:*:*:*:*:*:*:x86:*",
              "versionStartIncluding": "4.13.0",
              "versionEndExcluding": "4.17.0",
              "matchCriteriaId": "79DE0A8E-ACC5-420F-923D-E4FEAFBBB77A"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://xenbits.xenproject.org/xsa/advisory-472.html",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2025/09/09/1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://xenbits.xen.org/xsa/advisory-472.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}