CVE-2022-35414: debian debian_linux Use of Uninitialized Resource
Vulnerability summary
CVE-2022-35414 is a high (CVSS 8.8) Use of Uninitialized Resource vulnerability in debian debian_linux. EPSS estimates a 0.66% chance of exploitation in the next 30 days, higher than 51.7% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 7 · Related 6Timeline
- 11-07-2022PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translate_fail path, leading to an io_readx or io_writex crash. NOTE: a third party states that the Non-virtualization Use Case in the qemu.org reference applies here, i.e., "Bugs affecting the non-virtualization use case are not considered security bugs at this time.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS trend
Probability
0.66%
Chance of exploitation in the next 30 days
Percentile
52%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.66% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (sick.codes)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Debian2 products
- qemu< 1:7.1+dfsg-1
- debian_linuxEOL10.0
Qemu1 product
- qemu≥ 4.1.50, ≤ 7.0.0
2 vendors · 3 products
References
12 links- github.com/qemu/qemu/blob/f200ff158d5abcb974a6b597a962b6b2fbea2b06/softmmu/physmem.cX Refsource MISCPatchThird Party Advisory
- github.com/qemu/qemu/commit/418ade7849ce7641c0f7333718caf5091a02fd4cX Refsource MISCPatchThird Party Advisory
- github.com/qemu/qemu/commit/3517fb726741c109cae7995f9ea46f0cab6187d6X Refsource MISCPatchThird Party Advisory
- github.com/qemu/qemu/blob/v7.0.0/include/exec/cpu-all.hX Refsource MISCRelease NotesThird Party Advisory
- github.com/qemu/qemu/commit/3517fb726741c109cae7995f9ea46f0cab6187d6X Refsource MISCPatchThird Party Advisory
- gitlab.com/qemu-project/qemu/-/issues/1065X Refsource MISCIssue TrackingMitigationPatchThird Party Advisory
- www.mail-archive.com/qemu-devel%40nongnu.org/msg895266.htmlX Refsource MISC
lists.debian.org/debian-lts-announce/2022/09/msg00008.htmlMailing ListX Refsource MLISTThird Party Advisory
