CVE-2025-58149
published 2025-10-31CVE-2025-58149: When passing through PCI devices, the detach logic in libxl won't remove access permissions to any 64bit memory BARs the device might have. As a result a…
PriorityP343high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.40%
31.9th percentile
When passing through PCI devices, the detach logic in libxl won't remove
access permissions to any 64bit memory BARs the device might have. As a
result a domain can still have access any 64bit memory BAR when such
device is no longer assigned to the domain.
For PV domains the permission leak allows the domain itself to map the memory
in the page-tables. For HVM it would require a compromised device model or
stubdomain to map the leaked memory into the HVM domain p2m.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | xen | < xen 4.17.5+72-g01140da4e8-1 (bookworm) | xen 4.17.5+72-g01140da4e8-1 (bookworm) |
| xen | xen | >= 0 < 4.18.5-r3 | 4.18.5-r3 |
| xen | xen | >= 0 < 4.18.5-r3 | 4.18.5-r3 |
| xen | xen | >= 0 < 4.19.3-r2 | 4.19.3-r2 |
| xen | xen | >= 0 < 4.20.1-r2 | 4.20.1-r2 |
| xen | xen | >= 0 < 4.20.1-r2 | 4.20.1-r2 |
| xen | xen | >= 0 < 4.17.5+72-g01140da4e8-1 | 4.17.5+72-g01140da4e8-1 |
| xen | xen | >= 0 < 4.20.2+7-g1badcf5035-0+deb13u1 | 4.20.2+7-g1badcf5035-0+deb13u1 |
| xen | xen | >= 0 < 4.20.2+7-g1badcf5035-1 | 4.20.2+7-g1badcf5035-1 |
| xen | xen | >= 4.0.0 | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
osv7.5HIGH
vendor_debian7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2025-58149: When passing through PCI devices, the detach logic in libxl won't remove access permissions to any 64bit memory BARs the device might have
osv·2025-10-31·CVSS 7.5
CVE-2025-58149 [HIGH] CVE-2025-58149: When passing through PCI devices, the detach logic in libxl won't remove access permissions to any 64bit memory BARs the device might have
When passing through PCI devices, the detach logic in libxl won't remove access permissions to any 64bit memory BARs the device might have. As a result a domain can still have access any 64bit memory BAR when such device is no longer assigned to the domain. For PV domains the permission leak allows the domain itself to map the memory in the page-tables. For HVM it would require a compromised device model or stubdomain to map the leaked memory into the HVM domain p2m.
OSV
CVE-2025-58149: When passing through PCI devices, the detach logic in libxl won't remove
access permissions to any 64bit memory BARs the device might have
osv·2025-10-31·CVSS 7.5
CVE-2025-58149 [HIGH] CVE-2025-58149: When passing through PCI devices, the detach logic in libxl won't remove
access permissions to any 64bit memory BARs the device might have
When passing through PCI devices, the detach logic in libxl won't remove
access permissions to any 64bit memory BARs the device might have. As a
result a domain can still have access any 64bit memory BAR when such
device is no longer assigned to the domain.
For PV domains the permission leak allows the domain itself to map the memory
in the page-tables. For HVM it would require a compromised device model or
stubdomain to map the leaked memory into the HVM domain p2m.
GHSA
GHSA-38qg-7h9q-7h29: When passing through PCI devices, the detach logic in libxl won't remove
access permissions to any 64bit memory BARs the device might have
ghsa_unreviewed·2025-10-31
CVE-2025-58149 [HIGH] CWE-284 GHSA-38qg-7h9q-7h29: When passing through PCI devices, the detach logic in libxl won't remove
access permissions to any 64bit memory BARs the device might have
When passing through PCI devices, the detach logic in libxl won't remove
access permissions to any 64bit memory BARs the device might have. As a
result a domain can still have access any 64bit memory BAR when such
device is no longer assigned to the domain.
For PV domains the permission leak allows the domain itself to map the memory
in the page-tables. For HVM it would require a compromised device model or
stubdomain to map the leaked memory into the HVM domain p2m.
Debian
CVE-2025-58149: xen - When passing through PCI devices, the detach logic in libxl won't remove access ...
vendor_debian·2025·CVSS 7.5
CVE-2025-58149 [HIGH] CVE-2025-58149: xen - When passing through PCI devices, the detach logic in libxl won't remove access ...
When passing through PCI devices, the detach logic in libxl won't remove access permissions to any 64bit memory BARs the device might have. As a result a domain can still have access any 64bit memory BAR when such device is no longer assigned to the domain. For PV domains the permission leak allows the domain itself to map the memory in the page-tables. For HVM it would require a compromised device model or stubdomain to map the leaked memory into the HVM domain p2m.
Scope: local
bookworm: resolved (fixed in 4.17.5+72-g01140da4e8-1)
bullseye: open
forky: resolved (fixed in 4.20.2+7-g1badcf5035-1)
sid: resolved (fixed in 4.20.2+7-g1badcf5035-1)
trixie: resolved (fixed in 4.20.2+7-g1badcf5035-0+deb13u1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-10-31
Published