GSD-2022-1005696 KVM: x86: Mark TSS busy during LTR emulation _after_ all fault checks

KVM: x86: Mark TSS busy during LTR emulation after all fault checks This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.61 by commit...

PT-2022-34537 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.14.291 Description: The issue is related to the KVM x86 emulation of the LTR instruction, where the TSS is marked busy after all fault checks. The actual impact and attack plausibility have not yet been prove...

PT-2022-34579

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.9.326 Description The issue is related to KVM x86 and involves marking the TSS busy during LTR emulation after all fault checks. The actual impact and attack plausibility have not yet been proven...

PT-2022-34161

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.137 Description The issue is related to an oops in concurrently setting insn emulation sysctls. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions...

PT-2022-33954

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v3.17 through v5.15.60 Description The issue is related to the KVM x86 component, specifically with the LTR emulation. It involves marking the TSS busy after all fault checks. The actual impact and potential for attack ha...

PT-2022-33925

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.61 Description The issue is related to an oops in concurrently setting insn emulation sysctls on arm64. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...

PT-2022-34427

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.19.256 Description The issue is related to an oops in concurrently setting insn emulation sysctls on arm64. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...

PT-2022-34325 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions 3.17 through 5.4.210 Description: The issue is related to the KVM x86 component, specifically with the handling of the LTR emulation. The problem arises when marking the TSS busy during this emulation, potentially after...

PT-2022-34445

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.19.256 Description The issue is related to the KVM x86 component, specifically with the LTR emulation. It involves marking the TSS busy after all fault checks. The actual impact and potential for attack have n...

PT-2022-34524

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.14.291 Description The issue is related to an oops in concurrently setting insn emulation sysctls on arm64 architecture. The actual impact and attack plausibility have not yet been proven. Recommendations For...

PT-2022-33636

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.19.2 Description The issue is related to the KVM x86 emulation of the LTR instruction, where the TSS is marked busy after all fault checks. The actual impact and attack plausibility have not yet been proven...

QEMU Pointer Swapping DoS

The vulnerability of the QEMU hardware emulation software is related to pointer assignment errors. Exploiting this vulnerability allows an attacker to trigger a service failure...

QEMU USB Emulation

The vulnerability of QEMU’s emulation of hardware devices involves an incorrect pointer being freed. Exploiting this vulnerability can allow a remote attacker to access confidential data, compromise its integrity, and cause service failures...

QEMU Hardware Emulation Use-After-Free DoS

The vulnerability of the QEMU hardware emulation software is related to access to an uninitialized pointer. Exploiting this vulnerability can allow a malicious actor to cause a system failure...

DEBIAN-CVE-2022-2962

A DMA reentrancy issue was found in the Tulip device emulation in QEMU. When Tulip reads or writes to the rx/tx descriptor or copies the rx/tx frame, it doesn't check whether the destination address is its own MMIO address. This can cause the device to trigger MMIO handlers multiple times, possib...

AZL-35159 CVE-2022-2962 affecting package qemu for versions less than 6.2.0-18

A DMA reentrancy issue was found in the Tulip device emulation in QEMU. When Tulip reads or writes to the rx/tx descriptor or copies the rx/tx frame, it doesn't check whether the destination address is its own MMIO address. This can cause the device to trigger MMIO handlers multiple times, possib...

Design/Logic Flaw

A DMA reentrancy issue was found in the Tulip device emulation in QEMU. When Tulip reads or writes to the rx/tx descriptor or copies the rx/tx frame, it doesn't check whether the destination address is its own MMIO address. This can cause the device to trigger MMIO handlers multiple times, possib...

CVE-2022-2962

A DMA reentrancy issue was found in the Tulip device emulation in QEMU. When Tulip reads or writes to the rx/tx descriptor or copies the rx/tx frame, it doesn't check whether the destination address is its own MMIO address. This can cause the device to trigger MMIO handlers multiple times, possib...

CVE-2022-2962

A DMA reentrancy issue was found in the Tulip device emulation in QEMU. When Tulip reads or writes to the rx/tx descriptor or copies the rx/tx frame, it doesn't check whether the destination address is its own MMIO address. This can cause the device to trigger MMIO handlers multiple times, possib...

CVE-2022-2962: Uncontrolled Resource Consumption

A DMA reentrancy issue was found in the Tulip device emulation in QEMU. When Tulip reads or writes to the rx/tx descriptor or copies the rx/tx frame, it doesn't check whether the destination address is its own MMIO address. This can cause the device to trigger MMIO handlers multiple times, possib...