Incorrect removal of permissions on PCI device unplug
Summary
| CVE | CVE-2025-58149 |
|---|---|
| State | PUBLISHED |
| Assigner | XEN |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2025-10-31 12:15:35 UTC |
| Updated | 2026-10-19 13:10:00 UTC |
| Description | When passing through PCI devices, the detach logic in libxl won't remove access permissions to any 64bit memory BARs the device might have. As a result a domain can still have access any 64bit memory BAR when such device is no longer assigned to the domain. For PV domains the permission leak allows the domain itself to map the memory in the page-tables. For HVM it would require a compromised device model or stubdomain to map the leaked memory into the HVM domain p2m. |
Risk And Classification
Primary CVSS: v3.1 7.5 HIGH from ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Problem Types: CWE-672 | CWE-672 CWE-672 Operation on a Resource after Expiration or Release
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | ADP | DECLARED | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| 3.1 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
NoneAvailability
NoneCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD Known Affected Configurations (CPE 2.3)
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| xenbits.xenproject.org/xsa/advisory-476.html | [email protected] | xenbits.xenproject.org | Patch, Vendor Advisory |
| xenbits.xen.org/xsa/advisory-476.html | af854a3a-2127-422b-91ae-364da2661108 | xenbits.xen.org | Patch, Vendor Advisory |
| www.openwall.com/lists/oss-security/2025/10/24/1 | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | Mailing List, Patch, Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: This issue was discovered by Jiqian Chen of AMD and diagnosed as a security issue by Roger Pau Monné of XenServer. (en)
Additional Advisory Data
Workarounds
CNA: Not doing hot unplug of PCI devices will avoid the vulnerability. Passing through PCI devices to HVM domains only will also limit the impact, as an attacker would require another compromised component to exploit it.
There are currently no legacy QID mappings associated with this CVE.