CVE-2025-58148

{
  "id": "CVE-2025-58148",
  "sourceIdentifier": "[email protected]",
  "published": "2025-10-31T12:15:35.037",
  "lastModified": "2026-10-19T13:10:00.110",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nSome Viridian hypercalls can specify a mask of vCPU IDs as an input, in\none of three formats.  Xen has boundary checking bugs with all three\nformats, which can cause out-of-bounds reads and writes while processing\nthe inputs.\n\n * CVE-2025-58147.  Hypercalls using the HV_VP_SET Sparse format can\n   cause vpmask_set() to write out of bounds when converting the bitmap\n   to Xen's format.\n\n * CVE-2025-58148.  Hypercalls using any input format can cause\n   send_ipi() to read d->vcpu[] out-of-bounds, and operate on a wild\n   vCPU pointer."
    },
    {
      "lang": "es",
      "value": "Este registro de información de CNA se relaciona con múltiples CVEs; el texto explica qué aspectos/vulnerabilidades corresponden a qué CVE.\n\nAlgunas hiperllamadas de Viridian pueden especificar una máscara de IDs de vCPU como entrada, en uno de tres formatos. Xen tiene errores de comprobación de límites con los tres formatos, lo que puede causar lecturas y escrituras fuera de límites mientras procesa las entradas.\n\n* CVE-2025-58147. Las hiperllamadas que utilizan el formato HV_VP_SET Sparse pueden hacer que vpmask_set() escriba fuera de límites al convertir el mapa de bits al formato de Xen.\n\n* CVE-2025-58148. Las hiperllamadas que utilizan cualquier formato de entrada pueden hacer que send_ipi() lea d -> vcpu[] fuera de límites, y opere sobre un puntero vCPU no válido."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Xen",
          "product": "Xen",
          "defaultStatus": "unknown",
          "versions": [
            {
              "version": "consult Xen advisory XSA-475",
              "status": "unknown"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-11-03T14:25:18.838278Z",
          "id": "CVE-2025-58148",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        },
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.15.0",
              "matchCriteriaId": "E77C52A9-C85D-4198-B397-2F7BF859CBE7"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://xenbits.xenproject.org/xsa/advisory-475.html",
      "source": "[email protected]",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ]
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2025/10/21/1",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Patch",
        "Third Party Advisory"
      ]
    },
    {
      "url": "http://xenbits.xen.org/xsa/advisory-475.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ]
    }
  ]
}