Lucene search

K
ubuntucveUbuntu.comUB:CVE-2022-26362
HistoryJun 09, 2022 - 12:00 a.m.

CVE-2022-26362

2022-06-0900:00:00
ubuntu.com
ubuntu.com
20
x86
race condition
typeref acquisition
xen
safety
pagetables

CVSS2

6.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

CVSS3

6.4

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0

Percentile

14.2%

x86 pv: Race condition in typeref acquisition Xen maintains a type
reference count for pages, in addition to a regular reference count. This
scheme is used to maintain invariants required for Xen’s safety, e.g. PV
guests may not have direct writeable access to pagetables; updates need
auditing by Xen. Unfortunately, the logic for acquiring a type reference
has a race condition, whereby a safely TLB flush is issued too early and
creates a window where the guest can re-establish the read/write mapping
before writeability is prohibited.

Notes

Author Note
mdeslaur hypervisor packages are in universe. For issues in the hypervisor, add appropriate tags to each section, ex: Tags_xen: universe-binary

CVSS2

6.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

CVSS3

6.4

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0

Percentile

14.2%