CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-34322 – top-level shadow reference dropped too early for 64-bit PV guests
https://notcve.org/view.php?id=CVE-2023-34322
27 Sep 2023 — For migration as well as to work around kernels unaware of L1TF (see XSA-273), PV guests may be run in shadow paging mode. Since Xen itself needs to be mapped when PV guests run, Xen and shadowed PV guests run directly the respective shadow page tables. For 64-bit PV guests this means running on the shadow of the guest root page table. In the course of dealing with shortage of memory in the shadow pool associated with a domain, shadows of page tables may be torn down. This tearing down may include the shado... • https://xenbits.xenproject.org/xsa/advisory-438.html • CWE-273: Improper Check for Dropped Privileges •
CVSS: 9.3EPSS: 0%CPEs: 10EXPL: 0CVE-2023-34319 – Linux: buffer overrun in netback due to unusual packet
https://notcve.org/view.php?id=CVE-2023-34319
21 Aug 2023 — The fix for XSA-423 added logic to Linux'es netback driver to deal with a frontend splitting a packet in a way such that not all of the headers would come in one piece. Unfortunately the logic introduced there didn't account for the extreme case of the entire packet being split into as many pieces as permitted by the protocol, yet still being smaller than the area that's specially dealt with to keep all (possible) headers together. Such an unusual packet would therefore trigger a buffer overrun in the drive... • http://packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.html • CWE-787: Out-of-bounds Write •
CVSS: 6.5EPSS: 5%CPEs: 145EXPL: 2CVE-2023-20593 – hw: amd: Cross-Process Information Leak
https://notcve.org/view.php?id=CVE-2023-20593
24 Jul 2023 — An issue in “Zen 2” CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information. A flaw was found in hw, in “Zen 2” CPUs. This issue may allow an attacker to access sensitive information under specific microarchitectural circumstances. Daniel Moghimi discovered that some Intel Processors did not properly clear microarchitectural state after speculative execution of various instructions. A local unprivileged user could use this to obtain to sensiti... • https://github.com/sbaresearch/stop-zenbleed-win • CWE-209: Generation of Error Message Containing Sensitive Information CWE-1239: Improper Zeroization of Hardware Register •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2022-42331 – Debian Security Advisory 5378-1
https://notcve.org/view.php?id=CVE-2022-42331
21 Mar 2023 — x86: speculative vulnerability in 32bit SYSCALL path Due to an oversight in the very original Spectre/Meltdown security work (XSA-254), one entrypath performs its speculation-safety actions too late. In some configurations, there is an unprotected RET instruction which can be attacked with a variety of speculative attacks. Multiple vulnerabilities have been found in Xen, the worst of which can lead to arbitrary code execution. Versions greater than or equal to 4.16.6_pre1 are affected. • http://www.openwall.com/lists/oss-security/2023/03/21/3 •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2022-42332 – Debian Security Advisory 5378-1
https://notcve.org/view.php?id=CVE-2022-42332
21 Mar 2023 — x86 shadow plus log-dirty mode use-after-free In environments where host assisted address translation is necessary but Hardware Assisted Paging (HAP) is unavailable, Xen will run guests in so called shadow mode. Shadow mode maintains a pool of memory used for both shadow page tables as well as auxiliary data structures. To migrate or snapshot guests, Xen additionally runs them in so called log-dirty mode. The data structures needed by the log-dirty tracking are part of aformentioned auxiliary data. In order... • http://www.openwall.com/lists/oss-security/2023/03/21/1 • CWE-416: Use After Free •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2022-42334 – Debian Security Advisory 5378-1
https://notcve.org/view.php?id=CVE-2022-42334
21 Mar 2023 — x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To allow cachability control for HVM guests with passed through devices, an interface exists to explicitly override defaults which would otherwise be put in place. While not exposed to the affected guests themselves, the interface specifically exists for domains controlling such guests. This interface may therefore be used by not fully ... • http://www.openwall.com/lists/oss-security/2023/03/21/2 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 8.6EPSS: 0%CPEs: 4EXPL: 0CVE-2022-42333 – Debian Security Advisory 5378-1
https://notcve.org/view.php?id=CVE-2022-42333
21 Mar 2023 — x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To allow cachability control for HVM guests with passed through devices, an interface exists to explicitly override defaults which would otherwise be put in place. While not exposed to the affected guests themselves, the interface specifically exists for domains controlling such guests. This interface may therefore be used by not fully ... • http://www.openwall.com/lists/oss-security/2023/03/21/2 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2022-42310 – Gentoo Linux Security Advisory 202402-07
https://notcve.org/view.php?id=CVE-2022-42310
01 Nov 2022 — Xenstore: Guests can create orphaned Xenstore nodes By creating multiple nodes inside a transaction resulting in an error, a malicious guest can create orphaned nodes in the Xenstore data base, as the cleanup after the error will not remove all nodes already created. When the transaction is committed after this situation, nodes without a valid parent can be made permanent in the data base. Xenstore: los invitados pueden crear nodos huérfanos de Xenstore al crear varios nodos dentro de una transacción que ge... • http://www.openwall.com/lists/oss-security/2022/11/01/5 • CWE-459: Incomplete Cleanup •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2022-42319 – Gentoo Linux Security Advisory 202402-07
https://notcve.org/view.php?id=CVE-2022-42319
01 Nov 2022 — Xenstore: Guests can cause Xenstore to not free temporary memory When working on a request of a guest, xenstored might need to allocate quite large amounts of memory temporarily. This memory is freed only after the request has been finished completely. A request is regarded to be finished only after the guest has read the response message of the request from the ring page. Thus a guest not reading the response can cause xenstored to not free the temporary memory. This can result in memory shortages causing ... • http://www.openwall.com/lists/oss-security/2022/11/01/6 • CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2022-42325 – Gentoo Linux Security Advisory 202402-07
https://notcve.org/view.php?id=CVE-2022-42325
01 Nov 2022 — Xenstore: Guests can create arbitrary number of nodes via transactions T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] In case a node has been created in a transaction and it is later deleted in the same transaction, the transaction will be terminated with an error. As this error is encountered only when handling the deleted node at transaction finalization, the transaction will have been performed partially and without updatin... • http://www.openwall.com/lists/oss-security/2022/11/01/11 • CWE-401: Missing Release of Memory after Effective Lifetime •