CVE-2025-61553

{
  "id": "CVE-2025-61553",
  "sourceIdentifier": "[email protected]",
  "published": "2025-10-16T19:15:33.983",
  "lastModified": "2026-11-05T22:10:00.203",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An out-of-bounds write in VirtIO network device emulation in BitVisor from commit 108df6 (2020-05-20) to commit 480907 (2025-07-06) allows local attackers to cause a denial of service (host hypervisor crash) via a crafted PCI configuration space access. Given it's a heap overflow in a privileged hypervisor context, exploitation may enable arbitrary code execution or guest-to-host privilege escalation."
    },
    {
      "lang": "es",
      "value": "Una escritura fuera de límites en la emulación de dispositivo de red VirtIO en BitVisor desde el commit 108df6 (2020-05-20) hasta el commit 480907 (2025-07-06) permite a atacantes locales causar una denegación de servicio (caída del hipervisor anfitrión) mediante un acceso manipulado al espacio de configuración PCI. Dado que es un desbordamiento de montículo en un contexto de hipervisor privilegiado, su explotación podría permitir la ejecución de código arbitrario o la escalada de privilegios de invitado a anfitrión."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.5,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-10-17T13:25:47.866181Z",
          "id": "CVE-2025-61553",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-122"
        },
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/retrage/advisories/blob/main/CVE-2025-61553/README.md",
      "source": "[email protected]"
    },
    {
      "url": "https://sourceforge.net/p/bitvisor/code/ci/48090711ade5910b601d2b0034859a6a890cc82d/",
      "source": "[email protected]"
    }
  ]
}