CVE-2022-26362

🗓️ 09 Jun 2022 12:50:19Reported by XENType

cve🔗 web.nvd.nist.gov📰️ 7 Media mentions👁 102 Views

x86 pv: Race condition in typeref acquisition Xen maintains a type reference count for pages, in addition to a regular reference count. This scheme is used to maintain invariants required for Xen's safety, e.g. PV guests may not have direct writeable access to pagetables; updates need auditing by Xen. Unfortunately, the logic for acquiring a type reference has a race condition, whereby a safely TLB flush is issued too early and creates a window where the guest can re-establish the read/write mapping before writeability is prohibited

Reporter	Title	Published	Views	Family All 85
ATTACKERKB	CVE-2022-26362	9 Jun 202217:15	–	attackerkb
Circl	CVE-2022-26362	9 Jun 202220:33	–	circl
CNNVD	Xen 竞争条件问题漏洞	9 Jun 202200:00	–	cnnvd
Citrix	Citrix Hypervisor Security Update	23 Jun 202220:06	–	citrix
Cvelist	CVE-2022-26362	9 Jun 202212:50	–	cvelist
Debian	[SECURITY] [DSA 5184-1] xen security update	15 Jul 202218:05	–	debian
Debian CVE	CVE-2022-26362	9 Jun 202212:50	–	debiancve
Tenable Nessus	Debian DSA-5184-1 : xen - security update	16 Jul 202200:00	–	nessus
Tenable Nessus	GLSA-202208-23 : Xen: Multiple Vulnerabilities	15 Aug 202200:00	–	nessus
Tenable Nessus	SUSE SLED15 / SLES15 Security Update : xen (SUSE-SU-2022:2065-1)	14 Jun 202200:00	–	nessus

NVD

Node

xen xenx86

Node

fedoraproject fedoraMatch35

fedoraproject fedoraMatch36

Node

debian debian_linuxMatch11.0

[
  {
    "product": "xen",
    "vendor": "Xen",
    "versions": [
      {
        "status": "unknown",
        "version": "consult Xen advisory XSA-401"
      }
    ]
  }
]

Source	Link
xenbits	www.xenbits.xen.org/xsa/advisory-401.html
security	www.security.gentoo.org/glsa/202208-23
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RKRXZ4LHGCGMOG24ZCEJNY6R2BTS4S2Q/
openwall	www.openwall.com/lists/oss-security/2022/06/09/3
packetstormsecurity	www.packetstormsecurity.com/files/167718/Xen-TLB-Flush-Bypass.html
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OH65U6FTTB5MLH5A6Q3TW7KVCGOG4MYI/
debian	www.debian.org/security/2022/dsa-5184
xenbits	www.xenbits.xenproject.org/xsa/advisory-401.txt

21 Nov 2024 06:53Current

6.3Medium risk

Vulners AI Score6.3

CVSS 3.16.4

CVSS 26.9

EPSS0.00047

CWE-362