{"id":"CVE-2025-63913","aliases":["AZL-94302","DEBIAN-CVE-2025-63913","EUVD-2025-210523","GHSA-2rpc-x25h-pv3j","UBUNTU-CVE-2025-63913","USN-8853-1"],"status":"published","title":"An issue was discovered in OpenSBI 1.3 allowing attackers to cause a denial of service via...","description":"An issue was discovered in OpenSBI 1.3 allowing attackers to cause a denial of service via crafted request to the SBI function #2 or the 'Find and configure a matching counter' function of SBI PMU extension.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.0046,"percentile":0.40347,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2026-07-27T00:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"qemu","fixed_in":["0.0.0-0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"opensbi","fixed_in":["1.7-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"opensbi","fixed_in":["1.3-1ubuntu0.22.04.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0-0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"opensbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1-2","1.2-1","1.3-1","1.3.1-1","1.4-1","1.5-1","1.5.1-1","1.5.1-1~bpo12+1","1.5.1-1~bpo12+2","1.6-1","1.7-1","1.8.1-1","1.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"opensbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6-1","1.7-1","1.8.1-1","1.9-1"]},{"source":"osv","ecosystem":"Debian:14","package":"opensbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7-1"}]}],"versions":["1.6-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"opensbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3-1ubuntu0.22.04.3"}]}],"versions":["0.9-2ubuntu2","0.9+160.723aa88ff4-0ubuntu1","0.9+187.52af6e4b52-0ubuntu1","1.0-1","1.0-3ubuntu1","1.1-0ubuntu0.22.04.1","1.3-1ubuntu0.22.04.1","1.3-1ubuntu0.22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"opensbi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3-1ubuntu0.22.04.3"}]}],"versions":["0.9-2ubuntu2","0.9+160.723aa88ff4-0ubuntu1","0.9+187.52af6e4b52-0ubuntu1","1.0-1","1.0-3ubuntu1","1.1-0ubuntu0.22.04.1","1.3-1ubuntu0.22.04.1","1.3-1ubuntu0.22.04.2"]}],"references":[{"url":"https://github.com/luojia65/opensbi-pmu2-crash","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-63913","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2rpc-x25h-pv3j"},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-63913","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-63913","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-63913","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8853-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-63913","description":"An issue was discovered in OpenSBI 1.3 allowing attackers to cause a denial of service via crafted request to the SBI function #2 or the 'Find and configure a matching counter' function of SBI PMU extension.","status":"published","published":"2026-07-27T00:00:00Z","modified":"2026-07-28T13:37:44.677Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:32:45.503988Z"}],"euvd":[{"id":"EUVD-2025-210523","description":"An issue was discovered in OpenSBI 1.3 allowing attackers to cause a denial of service via crafted request to the SBI function #2 or the 'Find and configure a matching counter' function of SBI PMU extension.","status":"published","published":"2026-07-27T00:00:00Z","modified":"2026-07-28T13:37:44Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:02:31.827348Z"}],"ghsa":[{"id":"GHSA-2rpc-x25h-pv3j","title":"An issue was discovered in OpenSBI 1.3 allowing attackers to cause a denial of service via...","description":"An issue was discovered in OpenSBI 1.3 allowing attackers to cause a denial of service via crafted request to the SBI function #2 or the 'Find and configure a matching counter' function of SBI PMU extension.","status":"published","published":"2026-07-28T00:31:02Z","modified":"2026-07-28T15:33:18Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:09:52.627235Z"}],"nvd":[{"id":"CVE-2025-63913","description":"An issue was discovered in OpenSBI 1.3 allowing attackers to cause a denial of service via crafted request to the SBI function #2 or the 'Find and configure a matching counter' function of SBI PMU extension.","status":"published","published":"2026-07-27T23:16:39.717Z","modified":"2026-10-05T16:10:00.443Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:12:02.535029Z"}],"osv":[{"id":"DEBIAN-CVE-2025-63913","description":"An issue was discovered in OpenSBI 1.3 allowing attackers to cause a denial of service via crafted request to the SBI function #2 or the 'Find and configure a matching counter' function of SBI PMU extension.","status":"published","published":"2026-07-27T23:16:39.717Z","modified":"2026-10-06T10:00:06.125972017Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:47.697959Z"},{"id":"UBUNTU-CVE-2025-63913","description":"An issue was discovered in OpenSBI 1.3 allowing attackers to cause a denial of service via crafted request to the SBI function #2 or the 'Find and configure a matching counter' function of SBI PMU extension.","status":"published","published":"2026-07-27T23:16:00Z","modified":"2026-09-30T18:23:31.450459504Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:52.345622Z"},{"id":"AZL-94302","title":"CVE-2025-63913 affecting package qemu for versions less than 0.0.0-0","description":"An issue was discovered in OpenSBI 1.3 allowing attackers to cause a denial of service via crafted request to the SBI function #2 or the 'Find and configure a matching counter' function of SBI PMU extension.","status":"published","published":"2026-07-27T23:16:39Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.077208Z"},{"id":"USN-8853-1","title":"opensbi vulnerability","description":"It was discovered that OpenSBI did not properly validate the counter index\nmask in SBI PMU extension requests. An attacker could use this issue to\ncause a denial of service.","status":"published","published":"2026-09-30T13:02:21Z","modified":"2026-10-01T00:27:44.748611729Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}