[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
There are multiple issues related to the handling and accessing of guest
memory pages in the viridian code:
1. A NULL pointer dereference in the updating of the reference TSC area.
This is CVE-2025-27466.
2. A NULL pointer dereference by assuming the SIM page is mapped when
a synthetic timer message has to be delivered. This is
CVE-2025-58142.
3. A race in the mapping of the reference TSC page, where a guest can
get Xen to free a page while still present in the guest physical to
machine (p2m) page tables. This is CVE-2025-58143.
References
| Link | Resource |
|---|---|
| https://xenbits.xenproject.org/xsa/advisory-472.html | Vendor Advisory |
Configurations
History
22 Sep 2025, 18:53
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://xenbits.xenproject.org/xsa/advisory-472.html - Vendor Advisory | |
| CPE | cpe:2.3:o:xen:xen:*:*:*:*:*:*:x86:* | |
| First Time |
Xen
Xen xen |
11 Sep 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| CWE | CWE-395 |
11 Sep 2025, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-09-11 14:15
Updated : 2025-09-22 18:53
NVD link : CVE-2025-27466
Mitre link : CVE-2025-27466
CVE.ORG link : CVE-2025-27466
JSON object : View
Products Affected
xen
- xen
CWE
CWE-395
Use of NullPointerException Catch to Detect NULL Pointer Dereference