Xen varstored TOCTOU Vulnerability in UEFI Guest Memory Mapping (CVE-2025-58151)

Vulnerability Overview Vulnerability ID: XSA-478 CVE ID: CVE-2025-58151 Title: varstored: TOCTOU issues with mapped guest memory Published Date: 2025-01-27 12:00 Last Updated: 2025-01-27 12:00 Version: 2 is the component in the Xapi toolstack responsible for handling VM UEFI variables. It communicates with OVMF and involves mapping buffers prepared by OVMF. In , a lack of compiler barriers leads to a TOCTOU (Time-of-check to Time-of-use) issue with data in the shared buffer. The specific vulnerability behavior depends on the compiler-generated code. In a default-built , an attacker can control the index in the jump table. Impact Affected Systems: Systems using the Xapi toolstack may be affected. Affected Versions: All versions of may be affected. Exploitation Conditions: An x86 HVM VM configured as a UEFI VM can exploit this vulnerability. An x86 PV VM cannot exploit this vulnerability. Privilege Requirements: An attacker with kernel-level access can escalate privileges by achieving code execution in . Remediation Patch: Applying the attached patch resolves this issue. Patch Files: - - Patch Hashes: Additional Information Discoverer: This issue was discovered by Teddy Astie of Vates. Deployment During Pre-disclosure: Deployment of patches and/or mitigations is permitted during the pre-disclosure period, even on public-facing systems, even in the presence of untrusted guest users and administrators. Distribution Restriction: Distribution of the updated software is limited to members of the pre-disclosure list. Contact: Pre-disclosure list members wishing to deploy significantly different patches and/or mitigations should contact the Xen Project Security Team. Security Policy: For more information, please refer to the peer security policy in the Xen Project community.

Goal Reached Thanks to every supporter — we hit 100%!

Xen varstored TOCTOU Vulnerability in UEFI Guest Memory Mapping (CVE-2025-58151)