xen: patch with XSA-475

                  Xen Security Advisory #475

       x86: Incorrect input sanitisation in Viridian hypercalls

Some Viridian hypercalls can specify a mask of vCPU IDs as an input, in
one of three formats.  Xen has boundary checking bugs with all three
formats, which can cause out-of-bounds reads and writes while processing
the inputs.

 * CVE-2025-58147.  Hypercalls using the HV_VP_SET Sparse format can
   cause vpmask_set() to write out of bounds when converting the bitmap
   to Xen's format.

 * CVE-2025-58148.  Hypercalls using any input format can cause
   send_ipi() to read d->vcpu[] out-of-bounds, and operate on a wild
   vCPU pointer.

Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>

0 files changed, 0 insertions, 0 deletions