CVE-2025-58146 Details

A vulnerability in Xen's XAPI component allows for denial-of-service conditions through improper input handling. XAPI's UTF-8 encoder, which follows version 3.0 of the Unicode specification, can accept certain strings as valid UTF-8 that are rejected by other libraries conforming to the stricter version 3.1. This discrepancy can be exploited by guest administrators, leading to the introduction of malformed strings into the XAPI database. Once these strings are entered, they cause the database to become unreadable, disrupting normal operations. Additionally, there is a separate issue where updates to the XAPI database do not properly sanitize input strings before processing, causing the database's event thread to crash and halt further operations. This advisory also notes a lack of input sanitization for Map/Set updates on objects within the XAPI database, a vulnerability that can only be exploited by authenticated API users.

To address this vulnerability, an updated version of XAPI should be deployed, incorporating the patch available as part of this advisory. After applying the patch, XAPI can be restarted. If the restart is successful, no further action is needed. However, if malformed strings have been introduced into the database, they must be manually removed before XAPI can function properly. This can be done by stopping the XAPI service, backing up the database, using a command to strip bad characters from the database file, and then restarting the XAPI service.