CVE-2025-58149
Gravedad CVSS v3.1:
ALTA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
31/10/2025
Última modificación:
04/11/2025
Descripción
*** Pendiente de traducción *** When passing through PCI devices, the detach logic in libxl won&#39;t remove<br />
access permissions to any 64bit memory BARs the device might have. As a<br />
result a domain can still have access any 64bit memory BAR when such<br />
device is no longer assigned to the domain.<br />
<br />
For PV domains the permission leak allows the domain itself to map the memory<br />
in the page-tables. For HVM it would require a compromised device model or<br />
stubdomain to map the leaked memory into the HVM domain p2m.
Impacto
Puntuación base 3.x
7.50
Gravedad 3.x
ALTA