SB20251024128 - Fedora 43 update for xen
Published: October 24, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2025-58149)
The vulnerability allows a malicious guest to access sensitive information.
The vulnerability exists due to PCI detach logic in libxl that does not remove access permissions to any 64bit memory BARs the device might have. A malicious guest can access any 64bit memory BAR when such device is no longer assigned to the domain.
2) Out-of-bounds write (CVE-ID: CVE-2025-58147)
The vulnerability allows a malicious guest to escalate privileges on the system.
The vulnerability exists due to a boundary error within the vpmask_set() function when processing HV_VP_SET Sparse format. A malicious guest can initiate hypercall to trigger an out-of-bounds write and execute arbitrary code on the hypervisor.
3) Out-of-bounds read (CVE-ID: CVE-2025-58148)
The vulnerability allows a malicious guest to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition within the send_ipi() function. A malicious guest can initiate hypercalls using any input format to trigger an out-of-bounds read error and read contents of memory on the hypervisor.
Remediation
Install update from vendor's website.