CVE-2025-58148
Severity CVSS v4.0:
Pending analysis
Type:
CWE-125
Out-of-bounds Read
Publication date:
31/10/2025
Last modified:
04/11/2025
Description
[This CNA information record relates to multiple CVEs; the<br />
text explains which aspects/vulnerabilities correspond to which CVE.]<br />
<br />
Some Viridian hypercalls can specify a mask of vCPU IDs as an input, in<br />
one of three formats. Xen has boundary checking bugs with all three<br />
formats, which can cause out-of-bounds reads and writes while processing<br />
the inputs.<br />
<br />
* CVE-2025-58147. Hypercalls using the HV_VP_SET Sparse format can<br />
cause vpmask_set() to write out of bounds when converting the bitmap<br />
to Xen&#39;s format.<br />
<br />
* CVE-2025-58148. Hypercalls using any input format can cause<br />
send_ipi() to read d->vcpu[] out-of-bounds, and operate on a wild<br />
vCPU pointer.
Impact
Base Score 3.x
7.50
Severity 3.x
HIGH