CVE-2022-33741

2022-07-0512:50:33

XEN

www.cve.org

7.5 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

27.7%

JSON

Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don’t zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn’t allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742).

CNA Affected

[
  {
    "product": "Linux",
    "vendor": "Linux",
    "versions": [
      {
        "status": "unknown",
        "version": "consult Xen advisory XSA-403"
      }
    ]
  },
  {
    "product": "xen",
    "vendor": "Xen",
    "versions": [
      {
        "status": "unknown",
        "version": "consult Xen advisory XSA-403"
      }
    ]
  }
]