CVE-2025-58151
CriticalCVSS 9.4Summary
A vulnerability in the varstored component of the Xapi toolstack handling UEFI variables for VMs. Insufficient compiler barriers create TOCTOU issues in a shared buffer with OVMF, potentially allowing an attacker to control an index used in a jump table.
Risk Assessment
An attacker from within a VM could potentially manipulate control flow in varstored, leading to privilege escalation or compromise of UEFI variable integrity.
Recommendation
Immediately update varstored to a version with fixed compiler barriers and implement memory isolation mechanisms between VMs and varstored.
Original NVD description (English source)
varstored is a component of the Xapi toolstack handling UEFI Variables for a VM. It has a communication path with OVMF inside the VM involving mapping a buffer prepared by OVMF. Within varstored, there were insufficient compiler barriers, creating TOCTOU issues with data in the shared buffer. The exact vulnerable behaviour depends on the code generated by the compiler. In a build of varstored using default settings, the attacker can control an index used in a jump table.