Instruction Emulation Flaw in Xen Hypervisor
CVE-2025-27465
4.3MEDIUM
What is CVE-2025-27465?
A flaw exists in the instruction emulation logic of the Xen Hypervisor, where certain replayed instructions do not handle exceptions as expected. When the arithmetic flags recovery logic is triggered, the metadata involved in exception handling is incorrect, leading to failures in graceful exception management. As a result, what should have been a handled exception is treated as fatal, potentially compromising the stability of the system. This highlights the need for careful review and updates to ensure the integrity and reliability of the Xen Hypervisor.
Affected Version(s)
Xen consult Xen advisory XSA-470
References
CVSS V3.1
Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
This issue was discovered by Andrew Cooper of XenServer.