CVE-2022-26357

Aliases:DEBIAN-CVE-2022-26357ALPINE-CVE-2022-26357
Advisory lineage Upstream: 0 Downstream: 13
Modified
Published: 05 Apr 2022, 00:00
Last modified:03 Aug 2024, 05:03

Vulnerability Summary

Overall Risk (default)
medium
28/100
CVSS Score
7 HIGH
v3.1 (nvd)
EPSS Score
0.26% LOW
0% probability +0.24%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

05 Apr 2022, 00:00
Published
Vulnerability first disclosed
03 Aug 2024, 05:03
Last Modified
Vulnerability information updated

Description

race in VT-d domain ID cleanup Xen domain IDs are up to 15 bits wide. VT-d hardware may allow for only less than 15 bits to hold a domain ID associating a physical device with a particular domain. Therefore internally Xen domain IDs are mapped to the smaller value range. The cleaning up of the housekeeping structures has a race, allowing for VT-d domain IDs to be leaked and flushes to be bypassed.

CVSS Metrics

  • v3.1•HIGH•Score: 7CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  • v2.0•MEDIUM•Score: 6.2AV:L/AC:H/Au:N/C:C/I:C/A:C

EPSS Trends

Current EPSS score: 0.26%• Percentile: 18%

Techniques & Countermeasures

  • CWE-362•Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

    The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Affected Systems

  • alpine•xen

    ≥ 4.11.0, < 4.13.4-r3 | ≥ 4.11.0, < 4.14.5-r0 | ≥ 4.11.0, < 4.15.2-r2 | ≥ 4.11.0, < 4.15.2-r2 | ≥ 4.11.0, < 4.16.1-r0 | ≥ 4.11.0, < 4.16.1-r0 | ≥ 4.11.0, < 4.16.1-r0 | ≥ 4.11.0, < 4.16.1-r0 | ≥ 4.11.0, < 4.16.1-r0 | ≥ 4.11.0, < 4.16.1-r0 | ≥ 4.11.0, < 4.16.1-r0 | ≥ 4.11.0, < 4.16.1-r0 | ≥ 4.11.0, < 4.16.1-r0

  • debian•xen

    < 4.14.4+74-gd7b22226b5-1 | < 4.16.1-1 | < 4.16.1-1 | < 4.16.1-1

  • debian•debian_linux

    11.0

  • fedoraproject•fedora

    34 | 35

  • xen•xen

    ≥ 4.11.0, < 4.12.0 | ≥ 4.13.0, < 4.16.0

References (9)