CVE-2025-58148
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-31

Last updated on: 2025-11-04

Assigner: Xen Project

Description
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Some Viridian hypercalls can specify a mask of vCPU IDs as an input, in one of three formats. Xen has boundary checking bugs with all three formats, which can cause out-of-bounds reads and writes while processing the inputs. * CVE-2025-58147. Hypercalls using the HV_VP_SET Sparse format can cause vpmask_set() to write out of bounds when converting the bitmap to Xen's format. * CVE-2025-58148. Hypercalls using any input format can cause send_ipi() to read d->vcpu[] out-of-bounds, and operate on a wild vCPU pointer.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-31
Last Modified
2025-11-04
Generated
2026-05-07
AI Q&A
2025-11-01
EPSS Evaluated
2026-05-05
NVD
CVE-2025-58148
Affected Vendors & Products
Showing 5 associated CPEs
Vendor Product Version / Range
xen xen 4.18
xen xen 4.20
xen xen 4.19
xen xen 4.15
xen xen 4.17
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability (CVE-2025-58148) involves Xen hypercalls that accept a mask of virtual CPU (vCPU) IDs in various formats. Due to boundary checking bugs, the send_ipi() function can read beyond the valid range of the vCPU array, leading to out-of-bounds reads and operations on invalid vCPU pointers.


How can this vulnerability impact me? :

The vulnerability can lead to out-of-bounds memory reads and potentially cause the system to operate on invalid vCPU pointers. This may result in system instability, crashes, or unexpected behavior in the Xen hypervisor environment.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart