CRITICAL✓ PATCH🇵🇱 Wersja polska

CVE-2025-27466

CVSS 9.8v3.1pub. 2025-09-11upd. 2025-11-04

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are multiple issues related to the handling and accessing of guest memory pages in the viridian code: 1. A NULL pointer dereference in the updating of the reference TSC area. This is CVE-2025-27466. 2. A NULL pointer dereference by assuming the SIM page is mapped when a synthetic timer message has to be delivered. This is CVE-2025-58142. 3. A race in the mapping of the reference TSC page, where a guest can get Xen to free a page while still present in the guest physical to machine (p2m) page tables. This is CVE-2025-58143.

🤖 AI Analysis
How it works

In the viridian hypervisor code of Xen, during the update of the TSC reference area, an attempt to dereference a NULL pointer occurs (CWE-395 — Catch of NullPointerException). The bug is triggered during the handling of guest memory pages when the hypervisor does not properly check whether the appropriate pointer is initialized before using it. A malicious or misconfigured guest can provoke this condition, causing the hypervisor to crash.

Impact

An attacker with control over a virtual machine running on a vulnerable host can cause a Xen hypervisor crash, resulting in denial of service (DoS) for all other virtual machines running on the same host. A high CVSS score (9.8) indicates potentially broader impact, including the possibility of data confidentiality and integrity violations.

Mitigation & patch

Apply patches available from the vendor according to the references — see XSA-472 advisory published at https://xenbits.xenproject.org/xsa/advisory-472.html

Who is affected

Xen hypervisor — versions indicated in vendor references (XSA-472 advisory on xenbits.xenproject.org)

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Xen

    OS
    Xen
    4.13.0 – 4.17.0 (excl.)
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
CWE
References

Related vulnerabilities

CVE-2025-58143CRITICAL9.8PL ✓same product

Race condition w Xen viridian — zwolnienie strony obecnej w tablicach p2m

CVE-2025-58142CRITICAL9.8PL ✓same product

Xen: NULL pointer dereference w obsłudze syntetycznych timerów viridian

CVE-2019-18425CRITICAL9.8PL ✓same product

Xen: privilege escalation w 32-bitowym trybie PV guest przez deskryptory

CVE-2018-12892CRITICAL9.9PL ✓same product

Xen libxl: pominięcie flagi readonly dla dysków SCSI w qemu

CVE-2017-15597CRITICAL9.1PL ✓same product

Xen: uszkodzenie pamięci hypervisora przez operację grant copy na umierającej domenie