GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-58142 (GCVE-0-2025-58142)

Vulnerability from cvelistv5 – Published: 2025-09-11 14:05 – Updated: 2025-11-04 21:13
VLAI
Title
Mutiple vulnerabilities in the Viridian interface
Summary
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are multiple issues related to the handling and accessing of guest memory pages in the viridian code: 1. A NULL pointer dereference in the updating of the reference TSC area. This is CVE-2025-27466. 2. A NULL pointer dereference by assuming the SIM page is mapped when a synthetic timer message has to be delivered. This is CVE-2025-58142. 3. A race in the mapping of the reference TSC page, where a guest can get Xen to free a page while still present in the guest physical to machine (p2m) page tables. This is CVE-2025-58143.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: yes Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-11 14:24 UTC
CWE
  • CWE-395 - Use of NullPointerException Catch to Detect NULL Pointer Dereference
Assigner
References
Impacted products
Vendor Product Version CPE status
Xen Xen Unknown: consult Xen advisory XSA-472
guessed Create a notification for this product.
Date Public
2025-09-09 11:53
Credits
This issue was discovered by Roger Pau Monné of XenServer.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-58142",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-11T14:24:28.317871Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-395",
                "description": "CWE-395 Use of NullPointerException Catch to Detect NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-11T14:41:07.805Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T21:13:23.610Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://xenbits.xen.org/xsa/advisory-472.html"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/09/09/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Xen",
          "vendor": "Xen",
          "versions": [
            {
              "status": "unknown",
              "version": "consult Xen advisory XSA-472"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "Xen versions 4.13 and newer are vulnerable.  Xen versions 4.12 and older\nare not vulnerable.\n\nOnly x86 HVM guests which have the reference_tsc or stimer viridian\nextensions enabled are vulnerable."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This issue was discovered by Roger Pau Monn\u00e9 of XenServer."
        }
      ],
      "datePublic": "2025-09-09T11:53:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nThere are multiple issues related to the handling and accessing of guest\nmemory pages in the viridian code:\n\n 1. A NULL pointer dereference in the updating of the reference TSC area.\n    This is CVE-2025-27466.\n\n 2. A NULL pointer dereference by assuming the SIM page is mapped when\n    a synthetic timer message has to be delivered.  This is\n    CVE-2025-58142.\n\n 3. A race in the mapping of the reference TSC page, where a guest can\n    get Xen to free a page while still present in the guest physical to\n    machine (p2m) page tables.  This is CVE-2025-58143."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Denial of Service (DoS) affecting the entire host, information leaks, or\nelevation of privilege."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-11T14:05:29.649Z",
        "orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
        "shortName": "XEN"
      },
      "references": [
        {
          "url": "https://xenbits.xenproject.org/xsa/advisory-472.html"
        }
      ],
      "title": "Mutiple vulnerabilities in the Viridian interface",
      "workarounds": [
        {
          "lang": "en",
          "value": "Not enabling the reference_tsc and stimer viridian extensions will avoid\nthe issues."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
    "assignerShortName": "XEN",
    "cveId": "CVE-2025-58142",
    "datePublished": "2025-09-11T14:05:29.649Z",
    "dateReserved": "2025-08-26T06:48:41.442Z",
    "dateUpdated": "2025-11-04T21:13:23.610Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-58142",
      "date": "2026-09-16",
      "epss": "0.00467",
      "percentile": "0.39373"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-58142\",\"sourceIdentifier\":\"security@xen.org\",\"published\":\"2025-09-11T14:15:42.340\",\"lastModified\":\"2026-06-17T09:43:58.170\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"[This CNA information record relates to multiple CVEs; the\\ntext explains which aspects/vulnerabilities correspond to which CVE.]\\n\\nThere are multiple issues related to the handling and accessing of guest\\nmemory pages in the viridian code:\\n\\n 1. A NULL pointer dereference in the updating of the reference TSC area.\\n    This is CVE-2025-27466.\\n\\n 2. A NULL pointer dereference by assuming the SIM page is mapped when\\n    a synthetic timer message has to be delivered.  This is\\n    CVE-2025-58142.\\n\\n 3. A race in the mapping of the reference TSC page, where a guest can\\n    get Xen to free a page while still present in the guest physical to\\n    machine (p2m) page tables.  This is CVE-2025-58143.\"}],\"affected\":[{\"source\":\"security@xen.org\",\"affectedData\":[{\"vendor\":\"Xen\",\"product\":\"Xen\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"consult Xen advisory XSA-472\",\"status\":\"unknown\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-09-11T14:24:28.317871Z\",\"id\":\"CVE-2025-58142\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-395\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:xen:xen:*:*:*:*:*:*:x86:*\",\"versionStartIncluding\":\"4.13.0\",\"versionEndExcluding\":\"4.17.0\",\"matchCriteriaId\":\"79DE0A8E-ACC5-420F-923D-E4FEAFBBB77A\"}]}]}],\"references\":[{\"url\":\"https://xenbits.xenproject.org/xsa/advisory-472.html\",\"source\":\"security@xen.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2025/09/09/1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://xenbits.xen.org/xsa/advisory-472.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "current_release_date": "2026-06-28T11:13:23+00:00",
      "cve": "CVE-2025-58142",
      "id": "CVE-2025-58142",
      "initial_release_date": "2025-09-11T14:05:29.649000+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "xen: viridian: NULL pointer dereference by assuming the SIM page is mapped when a synthetic timer message has to be delivered",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-58142.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-28T16:51:51Z",
      "cve": "CVE-2025-58142",
      "id": "CVE-2025-58142",
      "initial_release_date": "2025-09-09T23:22:07Z",
      "product_status:known_affected": "74",
      "product_status:known_not_affected": "125",
      "product_status:recommended": "136",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-58142",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-58142.json",
      "version": "19"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://xenbits.xen.org/xsa/advisory-472.html\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2025/09/09/1\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-04T21:13:23.610Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-58142\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-09-11T14:24:28.317871Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-395\", \"description\": \"CWE-395 Use of NullPointerException Catch to Detect NULL Pointer Dereference\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-09-11T14:24:57.774Z\"}}], \"cna\": {\"title\": \"Mutiple vulnerabilities in the Viridian interface\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"This issue was discovered by Roger Pau Monn\\u00e9 of XenServer.\"}], \"impacts\": [{\"descriptions\": [{\"lang\": \"en\", \"value\": \"Denial of Service (DoS) affecting the entire host, information leaks, or\\nelevation of privilege.\"}]}], \"affected\": [{\"vendor\": \"Xen\", \"product\": \"Xen\", \"versions\": [{\"status\": \"unknown\", \"version\": \"consult Xen advisory XSA-472\"}], \"defaultStatus\": \"unknown\"}], \"datePublic\": \"2025-09-09T11:53:00.000Z\", \"references\": [{\"url\": \"https://xenbits.xenproject.org/xsa/advisory-472.html\"}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Not enabling the reference_tsc and stimer viridian extensions will avoid\\nthe issues.\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"[This CNA information record relates to multiple CVEs; the\\ntext explains which aspects/vulnerabilities correspond to which CVE.]\\n\\nThere are multiple issues related to the handling and accessing of guest\\nmemory pages in the viridian code:\\n\\n 1. A NULL pointer dereference in the updating of the reference TSC area.\\n    This is CVE-2025-27466.\\n\\n 2. A NULL pointer dereference by assuming the SIM page is mapped when\\n    a synthetic timer message has to be delivered.  This is\\n    CVE-2025-58142.\\n\\n 3. A race in the mapping of the reference TSC page, where a guest can\\n    get Xen to free a page while still present in the guest physical to\\n    machine (p2m) page tables.  This is CVE-2025-58143.\"}], \"configurations\": [{\"lang\": \"en\", \"value\": \"Xen versions 4.13 and newer are vulnerable.  Xen versions 4.12 and older\\nare not vulnerable.\\n\\nOnly x86 HVM guests which have the reference_tsc or stimer viridian\\nextensions enabled are vulnerable.\"}], \"providerMetadata\": {\"orgId\": \"23aa2041-22e1-471f-9209-9b7396fa234f\", \"shortName\": \"XEN\", \"dateUpdated\": \"2025-09-11T14:05:29.649Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-58142\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-11-04T21:13:23.610Z\", \"dateReserved\": \"2025-08-26T06:48:41.442Z\", \"assignerOrgId\": \"23aa2041-22e1-471f-9209-9b7396fa234f\", \"datePublished\": \"2025-09-11T14:05:29.649Z\", \"assignerShortName\": \"XEN\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.