CVE-2022-42327
First published: Tue Nov 01 2022(Updated: )
x86: unintended memory sharing between guests On Intel systems that support the "virtualize APIC accesses" feature, a guest can read and write the global shared xAPIC page by moving the local APIC out of xAPIC mode. Access to this shared page bypasses the expected isolation that should exist between two guests.
Credit: security@xen.org security@xen.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Xen XAPI | =4.16 | |
| Red Hat Fedora | =36 | |
| Red Hat Fedora | =37 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2022/11/01/3
- http://xenbits.xen.org/xsa/advisory-412.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLI2NPNEH7CNJO3VZGQNOI4M4EWLNKPZ/
- https://xenbits.xenproject.org/xsa/advisory-412.txt
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLI2NPNEH7CNJO3VZGQNOI4M4EWLNKPZ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YTMITQBGC23MSDHUCAPCVGLMVXIBXQTQ/
- https://security.gentoo.org/glsa/202402-07
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID is CVE-2022-42327.
What is the severity of CVE-2022-42327?
The severity of CVE-2022-42327 is high, with a severity value of 7.1.
Which software is affected by CVE-2022-42327?
Xen Xen version 4.16, Fedora 36, and Fedora 37 are affected by CVE-2022-42327.
How can a guest read and write the global shared xAPIC page in Intel systems?
A guest can read and write the global shared xAPIC page by moving the local APIC out of xAPIC mode on Intel systems that support the "virtualize APIC accesses" feature.
How can the unintended memory sharing between guests be fixed?
To fix the unintended memory sharing between guests, it is recommended to apply the necessary updates provided by the respective vendors.
- agent/type
- agent/remedy
- agent/references
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- vendor/xen
- canonical/xen xapi
- version/xen xapi/4.16
- vendor/fedoraproject
- canonical/red hat fedora
- version/red hat fedora/36
- version/red hat fedora/37