CVE-2025-1713 — Deadlock in XEN

CWE-833 — Deadlock6 documents5 sources
Severity
7.5HIGHNVD
EPSS
0.1%
top 69.02%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
XEN
Timeline
PublishedJul 17

Description

When setting up interrupt remapping for legacy PCI(-X) devices, including PCI(-X) bridges, a lookup of the upstream bridge is required. This lookup, itself involving acquiring of a lock, is done in a context where acquiring that lock is unsafe. This can lead to a deadlock.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶Alpinexen/xen< 4.17.5-r3+5
▶Debianxen/xen< 4.17.5+72-g01140da4e8-1+2
▶NVDxen/xen

Patches

Patch: xenbits.xenproject.org ↗Patch: xenbits.xen.org ↗

🔴Vulnerability Details

4
CVEList
deadlock potential with VT-d and legacy PCI device pass-through↗2025-07-17
▶
OSV
CVE-2025-1713: When setting up interrupt remapping for legacy PCI(-X) devices, including PCI(-X) bridges, a lookup of the upstream bridge is required↗2025-07-17
▶
GHSA
GHSA-h63j-vf47-m3ch: When setting up interrupt remapping for legacy PCI(-X) devices, including PCI(-X) bridges, a lookup of the upstream bridge is required↗2025-07-17
▶
OSV
CVE-2025-1713: When setting up interrupt remapping for legacy PCI(-X) devices, including PCI(-X) bridges, a lookup of the upstream bridge is required↗2025-07-17
▶

📋Vendor Advisories

1
Debian
CVE-2025-1713: xen - When setting up interrupt remapping for legacy PCI(-X) devices, including PCI(-X...↗2025
▶