CVSS: 7.1EPSS: 0%CPEs: 22EXPL: 0CVE-2022-33742
https://notcve.org/view.php?id=CVE-2022-33742
Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742). Unas fuga de datos de frontends de disco/NIC de Linux Este registro de información de CNA se relaciona con múltiples CVE; el texto explica qué aspectos/vulnerabilidades corresponden a qué CVE.] Las interfaces de dispositivos Linux Block y Network PV no ponen a cero las regiones de memoria antes de compartirlas con el backend (CVE-2022-26365, CVE-2022-33740). • http://www.openwall.com/lists/oss-security/2022/07/05/6 http://xenbits.xen.org/xsa/advisory-403.html https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGFTRZ66KQYTSYIRT5FRHF5D6O72NWOP https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RKRXZ4LHGCGMOG24ZCEJNY6R2BTS4S2Q https://www.debian.org/security/2022/dsa-5191 https://xenbits.xenproject.org/xsa/advisory-403&# • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.1EPSS: 0%CPEs: 22EXPL: 0CVE-2022-33741
https://notcve.org/view.php?id=CVE-2022-33741
Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742). Unas fuga de datos de frontends de disco/NIC de Linux Este registro de información de CNA se relaciona con múltiples CVE; el texto explica qué aspectos/vulnerabilidades corresponden a qué CVE.] Las interfaces de dispositivos Linux Block y Network PV no ponen a cero las regiones de memoria antes de compartirlas con el backend (CVE-2022-26365, CVE-2022-33740). • http://www.openwall.com/lists/oss-security/2022/07/05/6 http://xenbits.xen.org/xsa/advisory-403.html https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGFTRZ66KQYTSYIRT5FRHF5D6O72NWOP https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RKRXZ4LHGCGMOG24ZCEJNY6R2BTS4S2Q https://www.debian.org/security/2022/dsa-5191 https://xenbits.xenproject.org/xsa/advisory-403&# • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.1EPSS: 0%CPEs: 22EXPL: 0CVE-2022-33740
https://notcve.org/view.php?id=CVE-2022-33740
Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742). Unas fuga de datos de frontends de disco/NIC de Linux Este registro de información de CNA se relaciona con múltiples CVE; el texto explica qué aspectos/vulnerabilidades corresponden a qué CVE.] Las interfaces de dispositivos Linux Block y Network PV no ponen a cero las regiones de memoria antes de compartirlas con el backend (CVE-2022-26365, CVE-2022-33740). • http://www.openwall.com/lists/oss-security/2022/07/05/6 http://xenbits.xen.org/xsa/advisory-403.html https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGFTRZ66KQYTSYIRT5FRHF5D6O72NWOP https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RKRXZ4LHGCGMOG24ZCEJNY6R2BTS4S2Q https://www.debian.org/security/2022/dsa-5191 https://xenbits.xenproject.org/xsa/advisory-403&# • CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer •
CVSS: 7.1EPSS: 0%CPEs: 22EXPL: 0CVE-2022-26365
https://notcve.org/view.php?id=CVE-2022-26365
Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742). Unas fuga de datos de frontends de disco/NIC de Linux Este registro de información de CNA se relaciona con múltiples CVE; el texto explica qué aspectos/vulnerabilidades corresponden a qué CVE.] Las interfaces de dispositivos Linux Block y Network PV no ponen a cero las regiones de memoria antes de compartirlas con el backend (CVE-2022-26365, CVE-2022-33740). • http://www.openwall.com/lists/oss-security/2022/07/05/6 http://xenbits.xen.org/xsa/advisory-403.html https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGFTRZ66KQYTSYIRT5FRHF5D6O72NWOP https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RKRXZ4LHGCGMOG24ZCEJNY6R2BTS4S2Q https://www.debian.org/security/2022/dsa-5191 https://xenbits.xenproject.org/xsa/advisory-403&# • CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 1CVE-2022-2078 – kernel: buffer overflow in nft_set_desc_concat_parse()
https://notcve.org/view.php?id=CVE-2022-2078
A vulnerability was found in the Linux kernel's nft_set_desc_concat_parse() function .This flaw allows an attacker to trigger a buffer overflow via nft_set_desc_concat_parse() , causing a denial of service and possibly to run code. Se ha encontrado una vulnerabilidad en la función nft_set_desc_concat_parse() del kernel de Linux. Este fallo permite a un atacante desencadenar un desbordamiento de búfer por medio de la función nft_set_desc_concat_parse() , causando una denegación de servicio y posiblemente una ejecución de código • https://github.com/delsploit/CVE-2022-2078 https://bugzilla.redhat.com/show_bug.cgi?id=2096178 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/net/netfilter/nf_tables_api.c?id=fecf31ee395b0295f2d7260aa29946b7605f7c85 https://www.debian.org/security/2022/dsa-5161 https://access.redhat.com/security/cve/CVE-2022-2078 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE-121: Stack-based Buffer Overflow •