[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are multiple issues related to the handling and accessing of guest memory pages in the viridian code: 1. A NULL pointer dereference in the updating of the reference TSC area. This is CVE-2025-27466. 2. A NULL pointer dereference by assuming the SIM page is mapped when a synthetic timer message has to be delivered. This is CVE-2025-58142. 3. A race in the mapping of the reference TSC page, where a guest can get Xen to free a page while still present in the guest physical to machine (p2m) page tables. This is CVE-2025-58143.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities     correspond to which CVE.] There are multiple issues related to the handling and accessing of guest memory     pages in the viridian code: 1. A NULL pointer dereference in the updating of the reference TSC area. This     is CVE-2025-27466. 2. A NULL pointer dereference by assuming the SIM page is mapped when a synthetic timer     message has to be delivered. This is CVE-2025-58142. 3. A race in the mapping of the reference TSC page,     where a guest can get Xen to free a page while still present in the guest physical to machine (p2m) page     tables. This is CVE-2025-58143. (CVE-2025-58142)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03172-1 advisory.

    Security issues fixed:

    - CVE-2025-27466: NULL pointer dereference in the Viridian interface when updating the reference TSC area     (bsc#1248807).
    - CVE-2025-58142: NULL pointer dereference in the Viridian interface due to assumption that the SIM page     is mapped when       a synthetic timer message has to be delivered (bsc#1248807).
    - CVE-2025-58143: information leak and reference counter underflow in the Viridian interface due to race     in the mapping       of the reference TSC page (bsc#1248807).

    Other issues fixed:

    - efi: Call FreePages() only if needed (bsc#1027519).
    - x86/hpet: do local APIC EOI after interrupt processing (bsc#1027519).
    - x86/hvm/ioreq: Fix condition in hvm_alloc_legacy_ioreq_gfn() (bsc#1027519).
    - x86/idle: Fix the C6 eoi_errata[] list to include NEHALEM_EX (bsc#1027519).
    - x86/iommu: setup MMCFG ahead of IOMMU (bsc#1027519).
    - x86/mce: Adjustments to intel_init_ppin() (bsc#1027519).
    - x86/mkelf32: pad load segment to 2Mb boundary (bsc#1027519).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Xen hypervisor installed on the remote host is affected by multiple vulnerabilities:

  - A NULL pointer dereference in the updating of the reference TSC area. (CVE-2025-27466)

  - A NULL pointer dereference by assuming the SIM page is mapped when a synthetic timer message has to be delivered.     (CVE-2025-58142)

  - A race in the mapping of the reference TSC page, where a guest can get Xen to free a page while still present in the     guest physical to machine (p2m) page tables. (CVE-2025-58143)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
264778	Linux Distros Unpatched Vulnerability : CVE-2025-58142	Nessus	Misc.	critical
264614	SUSE SLED15 / SLES15 Security Update : xen (SUSE-SU-2025:03172-1)	Nessus	SuSE Local Security Checks	critical
264553	Citrix XenServer Multiple Vulnerabilities (XSA-472)	Nessus	Misc.	high

Detections

Analytics

CVE-2025-58142

critical

Tenable Plugins

critical

critical

high