CVE-2025-58149

Katalog CVE

CVSS 7.5 · High EPSS 0,43%

Kerentanan Operation on a Resource after Expiration or Release pada xen. Skor CVSS 3.1 7.5 (High) menurut CISA ADP.

Deskripsi (NVD)

When passing through PCI devices, the detach logic in libxl won't remove access permissions to any 64bit memory BARs the device might have. As a result a domain can still have access any 64bit memory BAR when such device is no longer assigned to the domain. For PV domains the permission leak allows the domain itself to map the memory in the page-tables. For HVM it would require a compromised device model or stubdomain to map the leaked memory into the HVM domain p2m.

Rincian

Terbit di NVD

31 Oktober 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-672: Operation on a Resource after Expiration or Release

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://xenbits.xenproject.org/xsa/advisory-476.html patch · advisory vendor
• http://xenbits.xen.org/xsa/advisory-476.html patch · advisory vendor
• http://www.openwall.com/lists/oss-security/2025/10/24/1 mailing list · patch · advisory pihak ketiga