ALPINE-CVE-2022-26363

Advisory lineage Upstream: 1 Downstream: 0
Upstream
CVE-2022-26363
Published: 09 Jun 2022, 17:15
Last modified:03 Dec 2025, 22:50

Vulnerability Summary

Overall Risk (default)
medium
27/100
CVSS Score
6.7 MEDIUM
3.1 (osv_alpine)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

09 Jun 2022, 17:15
Published
Vulnerability first disclosed
03 Dec 2025, 22:50
Last Modified
Vulnerability information updated

Description

x86 pv: Insufficient care with non-coherent mappings T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Xen maintains a type reference count for pages, in addition to a regular reference count. This scheme is used to maintain invariants required for Xen's safety, e.g. PV guests may not have direct writeable access to pagetables; updates need auditing by Xen. Unfortunately, Xen's safety logic doesn't account for CPU-induced cache non-coherency; cases where the CPU can cause the content of the cache to be different to the content in main memory. In such cases, Xen's safety logic can incorrectly conclude that the contents of a page is safe.

CVSS Metrics

  • v3.1•MEDIUM•Score: 6.7CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected Systems

  • alpine•xen

    < 4.14.5-r1 | < 4.15.2-r1 | < 4.15.2-r1 | < 4.16.1-r1 | < 4.16.1-r2 | < 4.16.1-r2 | < 4.16.1-r2 | < 4.16.1-r2 | < 4.16.1-r2 | < 4.16.1-r2 | < 4.16.1-r2

References (1)