CVE-2025-27465 (GCVE-0-2025-27465)
Vulnerability from cvelistv5
Published
2025-07-16 09:08
Modified
2025-07-17 15:00
Severity ?
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Summary
Certain instructions need intercepting and emulating by Xen. In some cases Xen emulates the instruction by replaying it, using an executable stub. Some instructions may raise an exception, which is supposed to be handled gracefully. Certain replayed instructions have additional logic to set up and recover the changes to the arithmetic flags. For replayed instructions where the flags recovery logic is used, the metadata for exception handling was incorrect, preventing Xen from handling the the exception gracefully, treating it as fatal instead.
References
Impacted products
Vendor Product Version
Xen Xen Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-27465",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-16T20:46:06.289437Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-755",
                "description": "CWE-755 Improper Handling of Exceptional Conditions",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-17T15:00:57.741Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Xen",
          "vendor": "Xen",
          "versions": [
            {
              "status": "unknown",
              "version": "consult Xen advisory XSA-470"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "Xen 4.9 and onwards are vulnerable.  Xen 4.8 and older are not\nvulnerable.\n\nOnly x86 systems are vulnerable.  ARM systems are not vulnerable.\n\nOnly HVM or PVH guests can leverage the vulnerability.  PV guests cannot\nleverage the vulnerability."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This issue was discovered by Andrew Cooper of XenServer."
        }
      ],
      "datePublic": "2025-07-01T11:56:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Certain instructions need intercepting and emulating by Xen.  In some\ncases Xen emulates the instruction by replaying it, using an executable\nstub.  Some instructions may raise an exception, which is supposed to be\nhandled gracefully.  Certain replayed instructions have additional logic\nto set up and recover the changes to the arithmetic flags.\n\nFor replayed instructions where the flags recovery logic is used, the\nmetadata for exception handling was incorrect, preventing Xen from\nhandling the the exception gracefully, treating it as fatal instead."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "An unprivileged guest can cause a hypervisor crash, causing a Denial of\nService (DoS) of the entire host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-16T09:08:39.931Z",
        "orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
        "shortName": "XEN"
      },
      "references": [
        {
          "url": "https://xenbits.xenproject.org/xsa/advisory-470.html"
        }
      ],
      "title": "x86: Incorrect stubs exception handling for flags recovery",
      "workarounds": [
        {
          "lang": "en",
          "value": "There are no mitigations."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
    "assignerShortName": "XEN",
    "cveId": "CVE-2025-27465",
    "datePublished": "2025-07-16T09:08:39.931Z",
    "dateReserved": "2025-02-26T09:16:54.461Z",
    "dateUpdated": "2025-07-17T15:00:57.741Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-27465\",\"sourceIdentifier\":\"security@xen.org\",\"published\":\"2025-07-16T09:15:23.040\",\"lastModified\":\"2025-07-17T15:15:25.500\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Certain instructions need intercepting and emulating by Xen.  In some\\ncases Xen emulates the instruction by replaying it, using an executable\\nstub.  Some instructions may raise an exception, which is supposed to be\\nhandled gracefully.  Certain replayed instructions have additional logic\\nto set up and recover the changes to the arithmetic flags.\\n\\nFor replayed instructions where the flags recovery logic is used, the\\nmetadata for exception handling was incorrect, preventing Xen from\\nhandling the the exception gracefully, treating it as fatal instead.\"},{\"lang\":\"es\",\"value\":\"Ciertas instrucciones requieren ser interceptadas y emuladas por Xen. En algunos casos, Xen emula la instrucci\u00f3n repiti\u00e9ndola mediante un stub ejecutable. Algunas instrucciones pueden generar una excepci\u00f3n, que deber\u00eda gestionarse correctamente. Algunas instrucciones repetidas tienen l\u00f3gica adicional para configurar y recuperar los cambios en las banderas aritm\u00e9ticas. En las instrucciones repetidas donde se utiliza la l\u00f3gica de recuperaci\u00f3n de banderas, los metadatos para la gesti\u00f3n de excepciones eran incorrectos, lo que impidi\u00f3 que Xen la gestionara correctamente, trat\u00e1ndola como fatal.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.8,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-755\"}]}],\"references\":[{\"url\":\"https://xenbits.xenproject.org/xsa/advisory-470.html\",\"source\":\"security@xen.org\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-27465\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-07-16T20:46:06.289437Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-755\", \"description\": \"CWE-755 Improper Handling of Exceptional Conditions\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-07-16T20:46:28.330Z\"}}], \"cna\": {\"title\": \"x86: Incorrect stubs exception handling for flags recovery\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"This issue was discovered by Andrew Cooper of XenServer.\"}], \"impacts\": [{\"descriptions\": [{\"lang\": \"en\", \"value\": \"An unprivileged guest can cause a hypervisor crash, causing a Denial of\\nService (DoS) of the entire host.\"}]}], \"affected\": [{\"vendor\": \"Xen\", \"product\": \"Xen\", \"versions\": [{\"status\": \"unknown\", \"version\": \"consult Xen advisory XSA-470\"}], \"defaultStatus\": \"unknown\"}], \"datePublic\": \"2025-07-01T11:56:00.000Z\", \"references\": [{\"url\": \"https://xenbits.xenproject.org/xsa/advisory-470.html\"}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"There are no mitigations.\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Certain instructions need intercepting and emulating by Xen.  In some\\ncases Xen emulates the instruction by replaying it, using an executable\\nstub.  Some instructions may raise an exception, which is supposed to be\\nhandled gracefully.  Certain replayed instructions have additional logic\\nto set up and recover the changes to the arithmetic flags.\\n\\nFor replayed instructions where the flags recovery logic is used, the\\nmetadata for exception handling was incorrect, preventing Xen from\\nhandling the the exception gracefully, treating it as fatal instead.\"}], \"configurations\": [{\"lang\": \"en\", \"value\": \"Xen 4.9 and onwards are vulnerable.  Xen 4.8 and older are not\\nvulnerable.\\n\\nOnly x86 systems are vulnerable.  ARM systems are not vulnerable.\\n\\nOnly HVM or PVH guests can leverage the vulnerability.  PV guests cannot\\nleverage the vulnerability.\"}], \"providerMetadata\": {\"orgId\": \"23aa2041-22e1-471f-9209-9b7396fa234f\", \"shortName\": \"XEN\", \"dateUpdated\": \"2025-07-16T09:08:39.931Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-27465\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-07-17T15:00:57.741Z\", \"dateReserved\": \"2025-02-26T09:16:54.461Z\", \"assignerOrgId\": \"23aa2041-22e1-471f-9209-9b7396fa234f\", \"datePublished\": \"2025-07-16T09:08:39.931Z\", \"assignerShortName\": \"XEN\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.