From 36e90c4ef1f2667dc8159c634fb00d393fc2d857 Mon Sep 17 00:00:00 2001 From: Teddy Astie Date: Tue, 21 Oct 2025 14:09:37 +0200 Subject: [PATCH] x86/viridian: Enforce bounds check in vpmask_set() Callers can pass vp/mask values which exceed the size of vpmask->mask. Ensure we only set bits which are within bounds. This is XSA-475 / CVE-2025-58147. Fixes: b4124682db6e ("viridian: add ExProcessorMasks variants of the flush hypercalls") Signed-off-by: Teddy Astie Reviewed-by: Andrew Cooper --- xen/arch/x86/hvm/viridian/viridian.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/xen/arch/x86/hvm/viridian/viridian.c b/xen/arch/x86/hvm/viridian/viridian.c index c0be24bd22..703f9ac8bc 100644 --- a/xen/arch/x86/hvm/viridian/viridian.c +++ b/xen/arch/x86/hvm/viridian/viridian.c @@ -562,7 +562,8 @@ static void vpmask_set(struct hypercall_vpmask *vpmask, unsigned int vp, if ( mask & 1 ) { - ASSERT(vp < HVM_MAX_VCPUS); + if ( vp >= HVM_MAX_VCPUS ) + break; __set_bit(vp, vpmask->mask); }