CVE-2025-58148
Gravedad CVSS v3.1:
ALTA
Tipo:
CWE-125
Lectura fuera de límites
Fecha de publicación:
31/10/2025
Última modificación:
04/11/2025
Descripción
*** Pendiente de traducción *** [This CNA information record relates to multiple CVEs; the<br />
text explains which aspects/vulnerabilities correspond to which CVE.]<br />
<br />
Some Viridian hypercalls can specify a mask of vCPU IDs as an input, in<br />
one of three formats. Xen has boundary checking bugs with all three<br />
formats, which can cause out-of-bounds reads and writes while processing<br />
the inputs.<br />
<br />
* CVE-2025-58147. Hypercalls using the HV_VP_SET Sparse format can<br />
cause vpmask_set() to write out of bounds when converting the bitmap<br />
to Xen&#39;s format.<br />
<br />
* CVE-2025-58148. Hypercalls using any input format can cause<br />
send_ipi() to read d->vcpu[] out-of-bounds, and operate on a wild<br />
vCPU pointer.
Impacto
Puntuación base 3.x
7.50
Gravedad 3.x
ALTA