CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-42335 – Gentoo Linux Security Advisory 202402-07
https://notcve.org/view.php?id=CVE-2022-42335
25 Apr 2023 — x86 shadow paging arbitrary pointer dereference In environments where host assisted address translation is necessary but Hardware Assisted Paging (HAP) is unavailable, Xen will run guests in so called shadow mode. Due to too lax a check in one of the hypervisor routines used for shadow page handling it is possible for a guest with a PCI device passed through to cause the hypervisor to access an arbitrary pointer partially under guest control. Multiple vulnerabilities have been found in Xen, the worst of whi... • http://www.openwall.com/lists/oss-security/2023/04/25/1 • CWE-476: NULL Pointer Dereference •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2022-42331 – Debian Security Advisory 5378-1
https://notcve.org/view.php?id=CVE-2022-42331
21 Mar 2023 — x86: speculative vulnerability in 32bit SYSCALL path Due to an oversight in the very original Spectre/Meltdown security work (XSA-254), one entrypath performs its speculation-safety actions too late. In some configurations, there is an unprotected RET instruction which can be attacked with a variety of speculative attacks. Multiple vulnerabilities have been found in Xen, the worst of which can lead to arbitrary code execution. Versions greater than or equal to 4.16.6_pre1 are affected. • http://www.openwall.com/lists/oss-security/2023/03/21/3 •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2022-42332 – Debian Security Advisory 5378-1
https://notcve.org/view.php?id=CVE-2022-42332
21 Mar 2023 — x86 shadow plus log-dirty mode use-after-free In environments where host assisted address translation is necessary but Hardware Assisted Paging (HAP) is unavailable, Xen will run guests in so called shadow mode. Shadow mode maintains a pool of memory used for both shadow page tables as well as auxiliary data structures. To migrate or snapshot guests, Xen additionally runs them in so called log-dirty mode. The data structures needed by the log-dirty tracking are part of aformentioned auxiliary data. In order... • http://www.openwall.com/lists/oss-security/2023/03/21/1 • CWE-416: Use After Free •
CVSS: 8.6EPSS: 0%CPEs: 4EXPL: 0CVE-2022-42333 – Debian Security Advisory 5378-1
https://notcve.org/view.php?id=CVE-2022-42333
21 Mar 2023 — x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To allow cachability control for HVM guests with passed through devices, an interface exists to explicitly override defaults which would otherwise be put in place. While not exposed to the affected guests themselves, the interface specifically exists for domains controlling such guests. This interface may therefore be used by not fully ... • http://www.openwall.com/lists/oss-security/2023/03/21/2 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2022-42334 – Debian Security Advisory 5378-1
https://notcve.org/view.php?id=CVE-2022-42334
21 Mar 2023 — x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To allow cachability control for HVM guests with passed through devices, an interface exists to explicitly override defaults which would otherwise be put in place. While not exposed to the affected guests themselves, the interface specifically exists for domains controlling such guests. This interface may therefore be used by not fully ... • http://www.openwall.com/lists/oss-security/2023/03/21/2 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-42330 – Gentoo Linux Security Advisory 202402-07
https://notcve.org/view.php?id=CVE-2022-42330
26 Jan 2023 — Guests can cause Xenstore crash via soft reset When a guest issues a "Soft Reset" (e.g. for performing a kexec) the libxl based Xen toolstack will normally perform a XS_RELEASE Xenstore operation. Due to a bug in xenstored this can result in a crash of xenstored. Any other use of XS_RELEASE will have the same impact. Los invitados pueden provocar un fallo de Xenstore mediante un reinicio por software Cuando un invitado emite un "Reinicio por software" (por ejemplo, para realizar un kexec), la pila de herram... • https://security.gentoo.org/glsa/202402-07 •
CVSS: 5.5EPSS: 0%CPEs: 504EXPL: 0CVE-2022-23824 – Debian Security Advisory 5378-1
https://notcve.org/view.php?id=CVE-2022-23824
09 Nov 2022 — IBPB may not prevent return branch predictions from being specified by pre-IBPB branch targets leading to a potential information disclosure. IBPB no puede evitar que las predicciones de sucursales de retorno sean especificadas por objetivos de sucursales anteriores a IBPB, lo que lleva a una posible divulgación de información. Multiple vulnerabilities have been found in Xen, the worst of which can lead to arbitrary code execution. Versions greater than or equal to 4.16.6_pre1 are affected. • http://www.openwall.com/lists/oss-security/2022/11/10/2 •
CVSS: 8.8EPSS: 0%CPEs: 5EXPL: 0CVE-2022-42309 – Gentoo Linux Security Advisory 202402-07
https://notcve.org/view.php?id=CVE-2022-42309
01 Nov 2022 — Xenstore: Guests can crash xenstored Due to a bug in the fix of XSA-115 a malicious guest can cause xenstored to use a wrong pointer during node creation in an error path, resulting in a crash of xenstored or a memory corruption in xenstored causing further damage. Entering the error path can be controlled by the guest e.g. by exceeding the quota value of maximum nodes per domain. Xenstore: Los invitados pueden bloquear xenstored Debido a un error en la solución de XSA-115, un invitado malintencionado puede... • http://www.openwall.com/lists/oss-security/2022/11/01/4 • CWE-763: Release of Invalid Pointer or Reference •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2022-42310 – Gentoo Linux Security Advisory 202402-07
https://notcve.org/view.php?id=CVE-2022-42310
01 Nov 2022 — Xenstore: Guests can create orphaned Xenstore nodes By creating multiple nodes inside a transaction resulting in an error, a malicious guest can create orphaned nodes in the Xenstore data base, as the cleanup after the error will not remove all nodes already created. When the transaction is committed after this situation, nodes without a valid parent can be made permanent in the data base. Xenstore: los invitados pueden crear nodos huérfanos de Xenstore al crear varios nodos dentro de una transacción que ge... • http://www.openwall.com/lists/oss-security/2022/11/01/5 • CWE-459: Incomplete Cleanup •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2022-42311 – Debian Security Advisory 5272-1
https://notcve.org/view.php?id=CVE-2022-42311
01 Nov 2022 — Xenstore: guests can let run xenstored out of memory T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Malicious guests can cause xenstored to allocate vast amounts of memory, eventually resulting in a Denial of Service (DoS) of xenstored. There are multiple ways how guests can cause large memory allocations in xenstored: - - by issuing new requests to xenstored without reading the responses, causing the responses to be buffered ... • http://xenbits.xen.org/xsa/advisory-326.html • CWE-770: Allocation of Resources Without Limits or Throttling •