CVE-2025-58142
Mutiple vulnerabilities in the Viridian interface
In short
A vulnerability in Xen's Viridian interface allows a guest system to cause a crash by triggering a NULL pointer dereference when synthetic timer messages are delivered without proper memory page mapping. This can lead to denial of service.
Technical detail
CVE-2025-58142 involves a NULL pointer dereference in the Viridian code when delivering synthetic timer messages, assuming the SIM (Synthetic Interrupt Message) page is mapped without validation. A malicious guest can trigger this condition by manipulating synthetic timer operations, causing Xen to crash and denying service to other VMs. The vulnerability requires guest-level access and affects the hypervisor's stability.
Summary generated and translated by AI from the official description.
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
There are multiple issues related to the handling and accessing of guest
memory pages in the viridian code:
1. A NULL pointer dereference in the updating of the reference TSC area.
This is CVE-2025-27466.
2. A NULL pointer dereference by assuming the SIM page is mapped when
a synthetic timer message has to be delivered. This is
CVE-2025-58142.
3. A race in the mapping of the reference TSC page, where a guest can
get Xen to free a page while still present in the guest physical to
machine (p2m) page tables. This is CVE-2025-58143.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Xen · XenWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →