Xen Viridian Hypercall vpmask_set out-of-bounds write

Summaryinfo

A vulnerability was found in Xen and classified as critical. Affected is the function vpmask_set of the component Viridian Hypercall Handler. Executing a manipulation can lead to out-of-bounds write. The identification of this vulnerability is CVE-2025-58147. There is no exploit available. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability classified as critical was found in Xen (the affected version is unknown). This vulnerability affects the function vpmask_set of the component Viridian Hypercall Handler. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. The CWE definition for the vulnerability is CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Some Viridian hypercalls can specify a mask of vCPU IDs as an input, in one of three formats. Xen has boundary checking bugs with all three formats, which can cause out-of-bounds reads and writes while processing the inputs. * CVE-2025-58147. Hypercalls using the HV_VP_SET Sparse format can cause vpmask_set() to write out of bounds when converting the bitmap to Xen's format. * CVE-2025-58148. Hypercalls using any input format can cause send_ipi() to read d->vcpu[] out-of-bounds, and operate on a wild vCPU pointer.

The advisory is shared for download at xenbits.xen.org. This vulnerability was named CVE-2025-58147. The exploitation appears to be easy. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 01/07/2026).

The vulnerability scanner Nessus provides a plugin with the ID 271656 (Linux Distros Unpatched Vulnerability : CVE-2025-58147), which helps to determine the existence of the flaw in a target environment.

Applying a patch is able to eliminate this problem.

The vulnerability is also documented in the databases at Tenable (271656), EUVD (EUVD-2025-37345) and CERT Bund (WID-SEC-2025-2380). Once again VulDB remains the best source for vulnerability data.

Affected

• Debian Linux
• Fedora Linux
• SUSE Linux
• SUSE openSUSE
• Open Source Xen

Productinfo

Type

• Virtualization Software

Name

• Xen

License

• open-source

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion