CVE-2022-21123: Medium severity XEN Xen vulnerability
A flaw was found in hw. Incomplete cleanup of multi-core shared buffers for some Intel® Processors may allow an authenticated user to enable information disclosure via local access.
Other sources
Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
Some processors do not properly clean up and remove temporary or supporting resources after they have been used.
References:
https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/processor-mmio-stale-data-vulnerabilities.html
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.76.1.rt56.1220.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-1160.76.1.el7 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-372.26.1.rt7.183.el8_6 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-372.26.1.el8_6 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-147.76.1.el8_1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-193.93.1.el8_2 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-193.93.1.rt13.143.el8_2 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-305.65.1.rt7.137.el8_4 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-305.65.1.el8_4 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:5.14.0-162.6.1.el9_1 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:5.14.0-162.6.1.rt21.168.el9_1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:5.14.0-70.36.1.el9_0 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:5.14.0-70.36.1.rt21.108.el9_0 - Upgrade
Upgrade
debian/intel-microcodeto a version that resolves this vulnerability.Fixed in 3.20240813.1~deb11u1Fixed in 3.20250211.1~deb11u1Fixed in 3.20250211.1~deb12u1Fixed in 3.20231114.1~deb12u1Fixed in 3.20250211.1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/xento a version that resolves this vulnerability.Fixed in 4.14.6-1Fixed in 4.14.5+94-ge49571868d-1Fixed in 4.17.5+23-ga4e5191dc0-1+deb12u1Fixed in 4.17.5+23-ga4e5191dc0-1Fixed in 4.20.0-1Fixed in 4.20.0+68-g35cb38b222-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-21123?
CVE-2022-21123 is classified as a moderate severity vulnerability.
How do I fix CVE-2022-21123?
To fix CVE-2022-21123, update to the latest kernel versions provided by your distribution, such as 0:3.10.0-1160.76.1.rt56.1220.el7 or equivalent for your system.
Who is affected by CVE-2022-21123?
CVE-2022-21123 affects certain Intel processors and systems running specific kernel versions.
What kind of impact does CVE-2022-21123 have?
CVE-2022-21123 can lead to information disclosure through local access by authenticated users.
What are the affected software versions in CVE-2022-21123?
Affected software versions include specific Red Hat kernels, Debian kernel packages, and Intel microcode versions listed in the vulnerability details.