CVE-2022-26365
First published: Tue Jul 05 2022(Updated: )
Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742).
Credit: security@xen.org security@xen.org security@xen.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Linux kernel | >=2.6.13<4.9.322 | |
| Linux Linux kernel | >=4.14<4.14.287 | |
| Linux Linux kernel | >=4.19<4.19.251 | |
| Linux Linux kernel | >=5.4<5.4.204 | |
| Linux Linux kernel | >=5.10<5.10.129 | |
| Linux Linux kernel | >=5.15<5.15.53 | |
| Linux Linux kernel | >=5.18<5.18.10 | |
| Linux Linux kernel | =2.6.12-rc2 | |
| Linux Linux kernel | =2.6.12-rc3 | |
| Linux Linux kernel | =2.6.12-rc4 | |
| Linux Linux kernel | =2.6.12-rc5 | |
| Linux Linux kernel | =2.6.12-rc6 | |
| Linux Linux kernel | =5.19-rc1 | |
| Linux Linux kernel | =5.19-rc2 | |
| Linux Linux kernel | =5.19-rc3 | |
| Linux Linux kernel | =5.19-rc4 | |
| Linux Linux kernel | =5.19-rc5 | |
| Xen Xen | ||
| Debian Debian Linux | =10.0 | |
| Debian Debian Linux | =11.0 | |
| Fedoraproject Fedora | =35 | |
| Fedoraproject Fedora | =36 | |
| ubuntu/linux | <4.4.0-233.267 | 4.4.0-233.267 |
| ubuntu/linux | <4.15.0-194.205 | 4.15.0-194.205 |
| ubuntu/linux | <5.4.0-128.144 | 5.4.0-128.144 |
| ubuntu/linux | <5.15.0-48.54 | 5.15.0-48.54 |
| ubuntu/linux | <5.19~ | 5.19~ |
| ubuntu/linux-aws | <4.4.0-1112.118 | 4.4.0-1112.118 |
| ubuntu/linux-aws | <4.4.0-1148.163 | 4.4.0-1148.163 |
| ubuntu/linux-aws | <5.19~ | 5.19~ |
| ubuntu/linux-aws | <4.15.0-1142.154 | 4.15.0-1142.154 |
| ubuntu/linux-aws | <5.4.0-1086.93 | 5.4.0-1086.93 |
| ubuntu/linux-aws | <5.15.0-1020.24 | 5.15.0-1020.24 |
| ubuntu/linux-aws-5.0 | <5.19~ | 5.19~ |
| ubuntu/linux-aws-5.11 | <5.19~ | 5.19~ |
| ubuntu/linux-aws-5.13 | <5.19~ | 5.19~ |
| ubuntu/linux-aws-5.3 | <5.19~ | 5.19~ |
| ubuntu/linux-aws-5.4 | <5.19~ | 5.19~ |
| ubuntu/linux-aws-5.4 | <5.4.0-1086.93~18.04.1 | 5.4.0-1086.93~18.04.1 |
| ubuntu/linux-aws-5.8 | <5.19~ | 5.19~ |
| ubuntu/linux-aws-hwe | <5.19~ | 5.19~ |
| ubuntu/linux-aws-hwe | <4.15.0-1142.154~16.04.1 | 4.15.0-1142.154~16.04.1 |
| ubuntu/linux-azure | <5.19~ | 5.19~ |
| ubuntu/linux-azure | <5.15.0-1020.25 | 5.15.0-1020.25 |
| ubuntu/linux-azure | <5.4.0-1094.100 | 5.4.0-1094.100 |
| ubuntu/linux-azure | <4.15.0-1153.168~14.04.1 | 4.15.0-1153.168~14.04.1 |
| ubuntu/linux-azure | <4.15.0-1153.168~16.04.1 | 4.15.0-1153.168~16.04.1 |
| ubuntu/linux-azure-4.15 | <5.19~ | 5.19~ |
| ubuntu/linux-azure-4.15 | <4.15.0-1153.168 | 4.15.0-1153.168 |
| ubuntu/linux-azure-5.11 | <5.19~ | 5.19~ |
| ubuntu/linux-azure-5.13 | <5.19~ | 5.19~ |
| ubuntu/linux-azure-5.3 | <5.19~ | 5.19~ |
| ubuntu/linux-azure-5.4 | <5.19~ | 5.19~ |
| ubuntu/linux-azure-5.4 | <5.4.0-1094.100~18.04.1 | 5.4.0-1094.100~18.04.1 |
| ubuntu/linux-azure-edge | <5.19~ | 5.19~ |
| ubuntu/linux-azure-fde | <5.4.0-1094.100 | 5.4.0-1094.100 |
| ubuntu/linux-azure-fde | <5.19~ | 5.19~ |
| ubuntu/linux-azure-fde | <5.15.0-1020.25 | 5.15.0-1020.25 |
| ubuntu/linux-bluefield | <5.19~ | 5.19~ |
| ubuntu/linux-bluefield | <5.4.0-1047.52 | 5.4.0-1047.52 |
| ubuntu/linux-dell300x | <5.19~ | 5.19~ |
| ubuntu/linux-dell300x | <4.15.0-1054.59 | 4.15.0-1054.59 |
| ubuntu/linux-fips | <5.19~ | 5.19~ |
| ubuntu/linux-gcp | <5.19~ | 5.19~ |
| ubuntu/linux-gcp | <5.15.0-1018.24 | 5.15.0-1018.24 |
| ubuntu/linux-gcp | <4.15.0-1137.153~16.04.1 | 4.15.0-1137.153~16.04.1 |
| ubuntu/linux-gcp | <5.4.0-1090.98 | 5.4.0-1090.98 |
| ubuntu/linux-gcp-4.15 | <5.19~ | 5.19~ |
| ubuntu/linux-gcp-4.15 | <4.15.0-1137.153 | 4.15.0-1137.153 |
| ubuntu/linux-gcp-5.11 | <5.19~ | 5.19~ |
| ubuntu/linux-gcp-5.13 | <5.19~ | 5.19~ |
| ubuntu/linux-gcp-5.15 | <5.19~ | 5.19~ |
| ubuntu/linux-gcp-5.15 | <5.15.0-1018.24~20.04.1 | 5.15.0-1018.24~20.04.1 |
| ubuntu/linux-gcp-5.3 | <5.19~ | 5.19~ |
| ubuntu/linux-gcp-5.4 | <5.4.0-1092.101~18.04.1 | 5.4.0-1092.101~18.04.1 |
| ubuntu/linux-gcp-5.8 | <5.19~ | 5.19~ |
| ubuntu/linux-gke | <5.19~ | 5.19~ |
| ubuntu/linux-gke | <5.15.0-1016.19 | 5.15.0-1016.19 |
| ubuntu/linux-gke | <5.4.0-1084.90 | 5.4.0-1084.90 |
| ubuntu/linux-gke-4.15 | <5.19~ | 5.19~ |
| ubuntu/linux-gke-5.0 | <5.19~ | 5.19~ |
| ubuntu/linux-gke-5.15 | <5.15.0-1016.19~20.04.1 | 5.15.0-1016.19~20.04.1 |
| ubuntu/linux-gke-5.15 | <5.19~ | 5.19~ |
| ubuntu/linux-gke-5.3 | <5.19~ | 5.19~ |
| ubuntu/linux-gke-5.4 | <5.19~ | 5.19~ |
| ubuntu/linux-gkeop | <5.15.0-1003.5 | 5.15.0-1003.5 |
| ubuntu/linux-gkeop | <5.4.0-1054.57 | 5.4.0-1054.57 |
| ubuntu/linux-gkeop | <5.19~ | 5.19~ |
| ubuntu/linux-gkeop-5.4 | <5.19~ | 5.19~ |
| ubuntu/linux-hwe | <5.19~ | 5.19~ |
| ubuntu/linux-hwe | <4.15.0-194.205~16.04.1 | 4.15.0-194.205~16.04.1 |
| ubuntu/linux-hwe-5.11 | <5.19~ | 5.19~ |
| ubuntu/linux-hwe-5.13 | <5.19~ | 5.19~ |
| ubuntu/linux-hwe-5.15 | <5.15.0-48.54~20.04.1 | 5.15.0-48.54~20.04.1 |
| ubuntu/linux-hwe-5.15 | <5.19~ | 5.19~ |
| ubuntu/linux-hwe-5.4 | <5.19~ | 5.19~ |
| ubuntu/linux-hwe-5.4 | <5.4.0-128.144~18.04.1 | 5.4.0-128.144~18.04.1 |
| ubuntu/linux-hwe-5.8 | <5.19~ | 5.19~ |
| ubuntu/linux-hwe-edge | <5.19~ | 5.19~ |
| ubuntu/linux-ibm | <5.4.0-1034.38 | 5.4.0-1034.38 |
| ubuntu/linux-ibm | <5.19~ | 5.19~ |
| ubuntu/linux-ibm | <5.15.0-1015.17 | 5.15.0-1015.17 |
| ubuntu/linux-ibm-5.4 | <5.19~ | 5.19~ |
| ubuntu/linux-ibm-5.4 | <5.4.0-1034.38~18.04.1 | 5.4.0-1034.38~18.04.1 |
| ubuntu/linux-intel-5.13 | <5.19~ | 5.19~ |
| ubuntu/linux-intel-iotg | <5.19~ | 5.19~ |
| ubuntu/linux-intel-iotg | <5.15.0-1016.21 | 5.15.0-1016.21 |
| ubuntu/linux-intel-iotg-5.15 | <5.19~ | 5.19~ |
| ubuntu/linux-intel-iotg-5.15 | <5.15.0-1016.21~20.04.1 | 5.15.0-1016.21~20.04.1 |
| ubuntu/linux-kvm | <5.19~ | 5.19~ |
| ubuntu/linux-kvm | <4.4.0-1113.123 | 4.4.0-1113.123 |
| ubuntu/linux-kvm | <4.15.0-1128.133 | 4.15.0-1128.133 |
| ubuntu/linux-kvm | <5.4.0-1076.81 | 5.4.0-1076.81 |
| ubuntu/linux-kvm | <5.15.0-1018.22 | 5.15.0-1018.22 |
| ubuntu/linux-lowlatency | <5.19~ | 5.19~ |
| ubuntu/linux-lowlatency | <5.15.0-48.54 | 5.15.0-48.54 |
| ubuntu/linux-lowlatency-hwe-5.15 | <5.15.0-48.54~20.04.1 | 5.15.0-48.54~20.04.1 |
| ubuntu/linux-lowlatency-hwe-5.15 | <5.19~ | 5.19~ |
| ubuntu/linux-lts-xenial | <5.19~ | 5.19~ |
| ubuntu/linux-lts-xenial | <4.4.0-233.267~14.04.1 | 4.4.0-233.267~14.04.1 |
| ubuntu/linux-oem | <5.19~ | 5.19~ |
| ubuntu/linux-oem-5.10 | <5.19~ | 5.19~ |
| ubuntu/linux-oem-5.13 | <5.19~ | 5.19~ |
| ubuntu/linux-oem-5.14 | <5.14.0-1055.62 | 5.14.0-1055.62 |
| ubuntu/linux-oem-5.17 | <5.19~ | 5.19~ |
| ubuntu/linux-oem-5.17 | <5.17.0-1024.25 | 5.17.0-1024.25 |
| ubuntu/linux-oem-5.6 | <5.19~ | 5.19~ |
| ubuntu/linux-oem-6.0 | <5.19~ | 5.19~ |
| ubuntu/linux-oem-6.1 | <5.19~ | 5.19~ |
| ubuntu/linux-oem-osp1 | <5.19~ | 5.19~ |
| ubuntu/linux-oracle | <5.19~ | 5.19~ |
| ubuntu/linux-oracle | <5.4.0-1084.92 | 5.4.0-1084.92 |
| ubuntu/linux-oracle | <5.15.0-1018.23 | 5.15.0-1018.23 |
| ubuntu/linux-oracle | <4.15.0-1107.118 | 4.15.0-1107.118 |
| ubuntu/linux-oracle | <4.15.0-1107.118~16.04.1 | 4.15.0-1107.118~16.04.1 |
| ubuntu/linux-oracle-5.0 | <5.19~ | 5.19~ |
| ubuntu/linux-oracle-5.11 | <5.19~ | 5.19~ |
| ubuntu/linux-oracle-5.13 | <5.19~ | 5.19~ |
| ubuntu/linux-oracle-5.15 | <5.19~ | 5.19~ |
| ubuntu/linux-oracle-5.15 | <5.15.0-1018.23~20.04.1 | 5.15.0-1018.23~20.04.1 |
| ubuntu/linux-oracle-5.3 | <5.19~ | 5.19~ |
| ubuntu/linux-oracle-5.4 | <5.4.0-1084.92~18.04.1 | 5.4.0-1084.92~18.04.1 |
| ubuntu/linux-raspi | <5.19~ | 5.19~ |
| ubuntu/linux-raspi | <5.15.0-1015.17 | 5.15.0-1015.17 |
| ubuntu/linux-raspi | <5.4.0-1071.81 | 5.4.0-1071.81 |
| ubuntu/linux-raspi-5.4 | <5.4.0-1071.81~18.04.1 | 5.4.0-1071.81~18.04.1 |
| ubuntu/linux-raspi-5.4 | <5.19~ | 5.19~ |
| ubuntu/linux-raspi2 | <5.19~ | 5.19~ |
| ubuntu/linux-raspi2 | <4.15.0-1120.128 | 4.15.0-1120.128 |
| ubuntu/linux-raspi2-5.3 | <5.19~ | 5.19~ |
| ubuntu/linux-riscv | <5.19~ | 5.19~ |
| ubuntu/linux-riscv | <5.15.0-1019.22 | 5.15.0-1019.22 |
| ubuntu/linux-riscv-5.11 | <5.19~ | 5.19~ |
| ubuntu/linux-riscv-5.8 | <5.19~ | 5.19~ |
| ubuntu/linux-snapdragon | <5.19~ | 5.19~ |
| ubuntu/linux-snapdragon | <4.15.0-1138.148 | 4.15.0-1138.148 |
| ubuntu/linux-aws-5.15 | <5.19~ | 5.19~ |
| ubuntu/linux-aws-5.15 | <5.15.0-1020.24~20.04.1 | 5.15.0-1020.24~20.04.1 |
| ubuntu/linux-azure-5.15 | <5.19~ | 5.19~ |
| ubuntu/linux-azure-5.15 | <5.15.0-1020.25~20.04.1 | 5.15.0-1020.25~20.04.1 |
| ubuntu/linux-azure-fde-5.15 | <5.19~ | 5.19~ |
| ubuntu/linux-azure-fde-5.15 | <5.15.0-1020.25~20.04.1 | 5.15.0-1020.25~20.04.1 |
| debian/linux | <=4.19.249-2 | 4.19.304-1 5.10.197-1 5.10.205-2 6.1.66-1 6.1.69-1 6.6.13-1 6.6.15-2 |
| debian/xen | <=4.11.4+107-gef32c7afa2-1<=4.14.6-1<=4.14.5+94-ge49571868d-1 | 4.17.2+76-ge1f9cb16e2-1~deb12u1 4.17.2+76-ge1f9cb16e2-1 4.17.3+10-g091466ba55-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://xenbits.xen.org/xsa/advisory-403.html
- https://xenbits.xenproject.org/xsa/advisory-403.txt
- http://www.openwall.com/lists/oss-security/2022/07/05/6
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IGFTRZ66KQYTSYIRT5FRHF5D6O72NWOP/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RKRXZ4LHGCGMOG24ZCEJNY6R2BTS4S2Q/
- https://www.debian.org/security/2022/dsa-5191
- https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html
- https://launchpad.net/bugs/cve/CVE-2022-26365
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGFTRZ66KQYTSYIRT5FRHF5D6O72NWOP/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RKRXZ4LHGCGMOG24ZCEJNY6R2BTS4S2Q/
- https://xenbits.xen.org/xsa/advisory-403.html
- https://security-tracker.debian.org/tracker/CVE-2022-26365
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26365
- https://ubuntu.com/security/notices/USN-5572-1
- https://ubuntu.com/security/notices/USN-5579-1
- https://ubuntu.com/security/notices/USN-5572-2
- https://ubuntu.com/security/notices/USN-5623-1
- https://ubuntu.com/security/notices/USN-5624-1
- https://ubuntu.com/security/notices/USN-5633-1
- https://ubuntu.com/security/notices/USN-5635-1
- https://ubuntu.com/security/notices/USN-5640-1
- https://ubuntu.com/security/notices/USN-5644-1
- https://ubuntu.com/security/notices/USN-5648-1
- https://ubuntu.com/security/notices/USN-5655-1
- https://ubuntu.com/security/notices/USN-5668-1
- https://ubuntu.com/security/notices/USN-5669-1
- https://ubuntu.com/security/notices/USN-5669-2
- https://ubuntu.com/security/notices/USN-5677-1
- https://ubuntu.com/security/notices/USN-5678-1
- https://ubuntu.com/security/notices/USN-5679-1
- https://ubuntu.com/security/notices/USN-5682-1
- https://ubuntu.com/security/notices/USN-5683-1
- https://ubuntu.com/security/notices/USN-5684-1
- https://ubuntu.com/security/notices/USN-5687-1
- https://ubuntu.com/security/notices/USN-5695-1
- https://ubuntu.com/security/notices/USN-5706-1
- https://ubuntu.com/security/notices/USN-5773-1
- https://ubuntu.com/security/notices/USN-5789-1
- https://nvd.nist.gov/vuln/detail/CVE-2022-26365
- https://git.kernel.org/linus/1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
- https://git.kernel.org/linus/2f446ffe9d737e9a844b97887919c4fda18246e7
- https://ubuntu.com/security/CVE-2022-26365
Parent vulnerabilities
(Appears in the following advisories)
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/launchpad-cve
- source/Launchpad
- collector/nvd-api
- collector/nvd-cve
- source/NVD
- collector/nvd-index
- collector/security-tracker-debian
- source/Debian
- agent/software-canonical-lookup
- collector/usn-cve
- source/Ubuntu
- vendor/linux
- canonical/linux linux kernel
- version/linux linux kernel/2.6.13
- version/linux linux kernel/4.14
- version/linux linux kernel/4.19
- version/linux linux kernel/5.4
- version/linux linux kernel/5.10
- version/linux linux kernel/5.15
- version/linux linux kernel/5.18
- version/linux linux kernel/2.6.12-rc2
- version/linux linux kernel/2.6.12-rc3
- version/linux linux kernel/2.6.12-rc4
- version/linux linux kernel/2.6.12-rc5
- version/linux linux kernel/2.6.12-rc6
- version/linux linux kernel/5.19-rc1
- version/linux linux kernel/5.19-rc2
- version/linux linux kernel/5.19-rc3
- version/linux linux kernel/5.19-rc4
- version/linux linux kernel/5.19-rc5
- vendor/xen
- canonical/xen xen
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/10.0
- version/debian debian linux/11.0
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/35
- version/fedoraproject fedora/36
- package-manager/debian
- package-manager/ubuntu