CVE-2025-27466
Mutiple vulnerabilities in the Viridian interface
In short
A NULL pointer dereference vulnerability in Xen's Viridian hypervisor code allows a guest to crash the hypervisor by triggering an error when updating the reference TSC (Time Stamp Counter) area, potentially causing denial of service.
Technical detail
CVE-2025-27466 involves a NULL pointer dereference in the viridian reference TSC area update routine. The attack vector requires guest-level code execution within a Hyper-V-enabled guest; the vulnerability occurs when the hypervisor attempts to dereference a NULL pointer during TSC page handling. Impact is denial of service via hypervisor crash.
Summary generated and translated by AI from the official description.
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
There are multiple issues related to the handling and accessing of guest
memory pages in the viridian code:
1. A NULL pointer dereference in the updating of the reference TSC area.
This is CVE-2025-27466.
2. A NULL pointer dereference by assuming the SIM page is mapped when
a synthetic timer message has to be delivered. This is
CVE-2025-58142.
3. A race in the mapping of the reference TSC page, where a guest can
get Xen to free a page while still present in the guest physical to
machine (p2m) page tables. This is CVE-2025-58143.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Xen · XenWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →