CVE-2022-42328

2022-12-0700:00:00

ubuntu.com

guests

deadlock

linux netback driver

xsa-392

patch

deadlock

skb

packet

netpoll

xen-netback driver

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

27.7%

JSON

Guests can trigger deadlock in Linux netback driver T[his CNA information
record relates to multiple CVEs; the text explains which
aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392
introduced another issue which might result in a deadlock when trying to
free the SKB of a packet dropped due to the XSA-392 handling
(CVE-2022-42328). Additionally when dropping packages for other reasons the
same deadlock could occur in case of netpoll being active for the interface
the xen-netback driver is connected to (CVE-2022-42329).

Notes

Author	Note
rodrigo-zaiden	USN-5975-1 first publication included esm/xenial linux-gcp version 4.15.0-1146.162~16.04.1 by mistake, please refer to USN-6007-1.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchlinux< 4.15.0-206.217UNKNOWN
ubuntu20.04noarchlinux< 5.4.0-144.161UNKNOWN
ubuntu22.04noarchlinux< 5.15.0-67.74UNKNOWN
ubuntu22.10noarchlinux< 5.19.0-38.39UNKNOWN
ubuntu18.04noarchlinux-aws< 4.15.0-1151.164UNKNOWN
ubuntu20.04noarchlinux-aws< 5.4.0-1097.105UNKNOWN
ubuntu22.04noarchlinux-aws< 5.15.0-1031.35UNKNOWN
ubuntu22.10noarchlinux-aws< 5.19.0-1022.23UNKNOWN
ubuntu23.04noarchlinux-aws< 6.2.0-1002.2UNKNOWN
ubuntu20.04noarchlinux-aws-5.15< 5.15.0-1031.35~20.04.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	linux	< 4.15.0-206.217	UNKNOWN
ubuntu	20.04	noarch	linux	< 5.4.0-144.161	UNKNOWN
ubuntu	22.04	noarch	linux	< 5.15.0-67.74	UNKNOWN
ubuntu	22.10	noarch	linux	< 5.19.0-38.39	UNKNOWN
ubuntu	18.04	noarch	linux-aws	< 4.15.0-1151.164	UNKNOWN
ubuntu	20.04	noarch	linux-aws	< 5.4.0-1097.105	UNKNOWN
ubuntu	22.04	noarch	linux-aws	< 5.15.0-1031.35	UNKNOWN
ubuntu	22.10	noarch	linux-aws	< 5.19.0-1022.23	UNKNOWN
ubuntu	23.04	noarch	linux-aws	< 6.2.0-1002.2	UNKNOWN
ubuntu	20.04	noarch	linux-aws-5.15	< 5.15.0-1031.35~20.04.1	UNKNOWN