CVE-2025-58147

Description

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Some Viridian hypercalls can specify a mask of vCPU IDs as an input, in one of three formats. Xen has boundary checking bugs with all three formats, which can cause out-of-bounds reads and writes while processing the inputs. * CVE-2025-58147. Hypercalls using the HV_VP_SET Sparse format can cause vpmask_set() to write out of bounds when converting the bitmap to Xen's format. * CVE-2025-58148. Hypercalls using any input format can cause send_ipi() to read d->vcpu[] out-of-bounds, and operate on a wild vCPU pointer.

CVSS Metrics

• v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Trends

Current EPSS score: 0.36%• Percentile: 29%

Techniques & Countermeasures

• CWE-125•Out-of-bounds Read

  The product reads data past the end, or before the beginning, of the intended buffer.

Affected Systems

• alpine•xen

  ≥ 4.15.0, < 4.18.5-r3 | ≥ 4.15.0, < 4.18.5-r3 | ≥ 4.15.0, < 4.19.3-r2 | ≥ 4.15.0, < 4.20.1-r2 | ≥ 4.15.0, < 4.20.1-r2 | ≥ 4.15.0, < 4.20.1-r2

• debian•xen

  all | < 4.17.5+72-g01140da4e8-1 | < 4.20.2+7-g1badcf5035-0+deb13u1 | < 4.20.2+7-g1badcf5035-1

• xen•xen

  ≥ 4.15.0

References (5)

• https://xenbits.xenproject.org/xsa/advisory-475.html
• http://xenbits.xen.org/xsa/advisory-475.html
• http://www.openwall.com/lists/oss-security/2025/10/21/1
• https://security-tracker.debian.org/tracker/CVE-2025-58147
• https://security.alpinelinux.org/vuln/CVE-2025-58147