Time-of-Check to Time-of-Use Vulnerability in Xapi Toolstack for UEFI Variables

CVE-2025-58151

What is CVE-2025-58151?

The Xapi toolstack's varstored component, which manages UEFI Variables for virtual machines, exhibits a significant vulnerability due to inadequate compiler barriers. This oversight leads to Time-of-Check to Time-of-Use (TOCTOU) issues, allowing malicious actors to manipulate a jump table index under certain circumstances. The vulnerability's impact is contingent on the specific code compiled within varstored, particularly when default settings are applied, creating an avenue for unauthorized access that could compromise the integrity of virtual machine environments.

References