Skip to main content

varstored CVE-2025-58151

| EUVDEUVD-2025-210447 CRITICAL
Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)
2026-07-09 XEN GHSA-78gx-8v3c-jqwc
Information Disclosure Xen Suse Varstored
9.4
CVSS 4.0 · Vendor: XEN
Share

Severity by source

Vendor (XEN) PRIMARY
9.4 CRITICAL
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.1 HIGH

Attacker runs in a co-resident UEFI guest (AV:L); winning a compiler-dependent TOCTOU race warrants AC:H; guest-to-dom0 escape is a scope change (S:C) with full host impact.

3.1 AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SUSE
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (XEN).

CVSS VectorVendor: XEN

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

1
Analysis Generated
Jul 09, 2026 - 16:28 vuln.today

DescriptionCVE.org

varstored is a component of the Xapi toolstack handling UEFI Variables for a VM. It has a communication path with OVMF inside the VM involving mapping a buffer prepared by OVMF.

Within varstored, there were insufficient compiler barriers, creating TOCTOU issues with data in the shared buffer.

The exact vulnerable behaviour depends on the code generated by the compiler. In a build of varstored using default settings, the attacker can control an index used in a jump table.

AnalysisAI

Guest-to-host privilege escalation in varstored, the Xapi (XenServer/XCP-ng/Citrix Hypervisor) toolstack daemon that services UEFI variable requests for VMs, allows a malicious guest to corrupt control flow in the host-side process. Missing compiler barriers on a buffer shared with in-guest OVMF create a time-of-check/time-of-use race (CWE-367) that, in default builds, lets the attacker control an index into a jump table - yielding attacker-influenced execution in the toolstack. Tracked as Xen Security Advisory XSA-478 with a CVSS 4.0 base score of 9.4; no public exploit identified at time of analysis and not listed in CISA KEV.

Technical ContextAI

varstored runs in the control domain (dom0) as part of the Xapi toolstack and emulates UEFI variable storage for guests. It communicates with OVMF (the UEFI firmware) inside the VM through a memory buffer that OVMF prepares and varstored maps. Because varstored lacked sufficient compiler barriers when reading this shared region, the compiler was free to reorder or re-read fields, so validated values could change between the check and the use - the classic TOCTOU pattern of CWE-367 (Time-of-check Time-of-use Race Condition). The concrete impact is compiler-dependent: in a build with default settings, the generated code allowed a guest-controlled value to reach an index used in a jump table, turning a data race into control-flow influence. The single affected product per the CPE is cpe:2.3:a:xen:varstored (all versions until patched).

RemediationAI

Apply the varstored fix distributed through Xen Security Advisory XSA-478 (https://xenbits.xen.org/xsa/advisory-478.html) - the advisory carries the patch and the exact fixed builds; a released patched version number is not independently confirmed here, so use the version referenced in XSA-478 for your distribution (XenServer/Citrix Hypervisor/XCP-ng packages). Until patched, the most direct compensating control is to avoid running untrusted guests with UEFI firmware: configure sensitive workloads to boot via the legacy BIOS/hvmloader path rather than OVMF so the varstored communication buffer is not exercised, accepting that UEFI-dependent guests (Secure Boot, some modern OS installs) cannot use this mode. Additionally, restrict which tenants can launch UEFI VMs and keep guest workloads you do not fully trust off hosts that also run UEFI guests, since the attack originates from within a guest. Coordinate timing using the oss-security notice (http://www.openwall.com/lists/oss-security/2026/01/27/2).

More in Xen

View all
CVE-2012-0217 HIGH POC
7.2 Jun 12

The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and

CVE-2015-3456 HIGH POC
7.7 May 13

The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a

CVE-2018-8897 HIGH POC
7.8 May 08

A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) wa
CVE-2022-4949 HIGH POC
8.8 Jun 07

The AdSanity plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'aj
CVE-2017-15595 HIGH POC
8.8 Oct 18

An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to cause a denial of service (unbounded recu
CVE-2017-7228 HIGH POC
8.2 Apr 04

An issue (known as XSA-212) was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. Rated
CVE-2015-5165 CRITICAL
9.3 Aug 12

The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows
CVE-2015-8550 HIGH
8.2 Apr 14

Xen, when used on a system providing PV backends, allows local guest OS administrators to cause a denial of service (hos
CVE-2022-26364 MEDIUM POC
6.7 Jun 09

x86 pv: Insufficient care with non-coherent mappings T[his CNA information record relates to multiple CVEs; the text exp
CVE-2017-10918 CRITICAL
10.0 Jul 05

Xen through 4.8.x does not validate memory allocations during certain P2M operations, which allows guest OS users to obt
CVE-2017-10912 CRITICAL
10.0 Jul 05

Xen through 4.8.x mishandles page transfer, which allows guest OS users to obtain privileged host OS access, aka XSA-217
CVE-2017-10921 CRITICAL
10.0 Jul 05

The grant-table feature in Xen through 4.8.x does not ensure sufficient type counts for a GNTMAP_device_map and GNTMAP_h

Same weakness CWE-367 – Time-of-check Time-of-use (TOCTOU) Race Condition

View all
CVE-2024-30088 HIGH POC
7.0
CVE-2025-22224 CRITICAL
9.3
CVE-2025-38352 HIGH POC
7.8
CVE-2022-48618 HIGH
7.0
CVE-2023-38146 HIGH POC
8.8
CVE-2025-34027 CRITICAL POC
10.0
CVE-2020-1337 HIGH POC
7.8
CVE-2026-25641 CRITICAL POC
10.0

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Micro 5.3 Not-Affected
SUSE Linux Enterprise Micro 5.4 Not-Affected
SUSE Linux Enterprise Micro 5.5 Not-Affected

Share

CVE-2025-58151 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy