CVE-2025-54567: 
NixOS vulnerability analysis and mitigation

CVE-2025-54567 is a vulnerability in QEMU's PCIe SR-IOV implementation where hw/pci/pcie_sriov.c mishandles the VF (Virtual Function) Enable bit write mask, related to the previously disclosed CVE-2024-26327. It affects QEMU through version 10.0.3 and was published on July 25, 2025. The vulnerability is classified as CWE-684 (Incorrect Provision of Specified Functionality) and carries a CVSS v3.1 base score of 5.4 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is an incorrect write mask applied to the VF Enable bit in QEMU's PCIe SR-IOV handling code (hw/pci/pcie_sriov.c), classified as CWE-684 (Incorrect Provision of Specified Functionality). This mishandling is related to CVE-2024-26327, suggesting a pattern of incomplete fixes or adjacent logic errors in the SR-IOV subsystem. An attacker on an adjacent network segment could potentially manipulate PCI SR-IOV configuration state by exploiting the improperly masked write operation, without requiring authentication or user interaction. The upstream fix is available as a commit to the QEMU project repository (Red Hat Bugzilla, QEMU Commit).

Successful exploitation could result in limited integrity and availability impacts on the affected QEMU instance, specifically affecting PCI SR-IOV functionality. An adjacent-network attacker could cause minor unauthorized modifications to virtualized PCI device state or low-level disruptions to SR-IOV operations. Confidentiality is not impacted, and the scope is unchanged, meaning the impact is contained to the vulnerable component rather than enabling broader host or hypervisor compromise (Red Hat Advisory).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been reported. The EPSS score is approximately 0.015% (0.000150), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available from Nessus (IDs: 254417, 258071, 310544, 310733) and Qualys (ID: 164387) (Red Hat Advisory).

The upstream fix has been committed to the QEMU project repository (commit cad9aa6fbdccd95e56e10cfa57c354a20a333717) and users should update QEMU to a version beyond 10.0.3 that includes this patch (Red Hat Bugzilla, QEMU Commit). Debian has issued DSA-5983-1 addressing this vulnerability in its QEMU packages, and openSUSE Tumbleweed included the fix in its August 2025 monthly update. As interim mitigations, administrators should implement network segmentation to restrict adjacent network access to QEMU hosts, apply strict network access controls, and monitor PCI and SR-IOV configurations for unexpected changes.

Red Hat tracked the issue via Bugzilla (Bug 2383340) and assigned it medium priority/severity, with the upstream fix identified by Mauro Matteo Cascella. Debian issued security advisory DSA-5983-1 for QEMU packages, and openSUSE noted the fix in its August 2025 Tumbleweed monthly update. Microsoft's Security Response Center also published a reference entry for this CVE. Community coverage has been limited, consistent with the vulnerability's moderate severity and lack of public exploit code (Red Hat Bugzilla).