CVE-2025-8860: 
Wolfi vulnerability analysis and mitigation

CVE-2025-8860 is an information disclosure vulnerability in QEMU's uefi-vars virtual device, affecting the uefi_vars_write callback. When a guest writes to the UEFI_VARS_REG_BUFFER_SIZE register, a heap buffer is allocated without being zeroed, leaving it populated with residual data from prior allocations. A subsequent guest read from UEFI_VARS_REG_PIO_BUFFER_TRANSFER via uefi_vars_read can expose leftover metadata or other sensitive host process memory. The vulnerability was reported on August 11, 2025, with an upstream fix committed on August 24, 2025. It carries a CVSS v3.1 base score of 3.3 (Low) (Red Hat CVE, Red Hat Bugzilla).

The root cause is classified as CWE-212 (Improper Removal of Sensitive Information Before Storage or Transfer). The uefi_vars_write function in QEMU's uefi-vars virtual device allocates a heap buffer using a non-zeroing allocator, meaning the buffer retains residual content from previously freed memory regions. A low-privileged guest user can trigger this by writing to UEFI_VARS_REG_BUFFER_SIZE and then reading from UEFI_VARS_REG_PIO_BUFFER_TRANSFER, causing uefi_vars_read to return uninitialized heap contents to the guest. The attack vector is local, requires low privileges, and no user interaction, with the scope remaining unchanged (Red Hat Bugzilla, Red Hat CVE). The upstream fix is available at the QEMU GitLab repository commit f757d9d90d19b914d4023663bfc4da73bbbf007e (Red Hat Bugzilla).

Successful exploitation allows a low-privileged guest to read residual heap memory from the QEMU host process, potentially exposing sensitive metadata, cryptographic material, or other process memory contents. The confidentiality impact is rated Low, with no integrity or availability impact. The vulnerability is scoped to the host QEMU process and does not directly enable guest-to-host escape or lateral movement, but leaked memory contents could assist in chaining with other vulnerabilities (Red Hat CVE, Red Hat Bugzilla).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-8860. The EPSS score is extremely low at 0.005%, reflecting minimal near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available from Qualys (ID: 6272043, 164387) and Nessus (IDs: 310544, 310733) (Red Hat CVE, ZDI Advisory).

1. Access a guest VM: Obtain low-privileged access to a guest virtual machine running on a QEMU/KVM host with the uefi-vars virtual device enabled (typically used with UEFI firmware configurations).
2. Trigger buffer allocation: Write a specific value to the UEFI_VARS_REG_BUFFER_SIZE PIO register from within the guest, invoking the uefi_vars_write callback, which allocates an uninitialized heap buffer in the QEMU host process.
3. Read uninitialized memory: Read from the UEFI_VARS_REG_PIO_BUFFER_TRANSFER PIO register, triggering uefi_vars_read, which returns the contents of the uninitialized heap buffer — potentially containing residual host process memory.
4. Analyze leaked data: Parse the returned data for sensitive artifacts such as cryptographic keys, pointers, or metadata that could be leveraged for further exploitation (Red Hat Bugzilla).

The upstream fix was committed to the QEMU project repository at commit f757d9d90d19b914d4023663bfc4da73bbbf007e, which ensures the heap buffer is zeroed upon allocation in uefi_vars_write. Users should update QEMU to a version incorporating this fix. Red Hat has tracked this issue in Bugzilla (Bug 2387588) and Fedora package updates including QEMU have been released. As a workaround where patching is not immediately possible, restricting guest access to UEFI variable device functionality or disabling the uefi-vars virtual device may reduce exposure (Red Hat Bugzilla, Linux Compatible).

The vulnerability received coverage from SystemTek and InfinitSec, which published technical summaries of the flaw. The Zero Day Initiative published an advisory (ZDI-25-884) covering the issue. Community reaction has been muted given the low CVSS score and limited exploitation potential, with no significant social media discussion identified (ZDI Advisory, SystemTek).