Veracode Vulnerability DatabaseVERACODE:35021Out Of Bound Reads
3.2 Low
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L
2.1 Low
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:N/I:N/A:P
vhost-vsockis vulnerable to out of bound reads. The vulnerability exists because, case of error, an invalid element was not detached from the virtqueue before freeing its memory, leading to memory leakage and other unexpected results.
References
access.redhat.com/errata/RHSA-2022:5002
access.redhat.com/errata/RHSA-2022:5263
access.redhat.com/errata/RHSA-2022:5821
access.redhat.com/security/cve/CVE-2022-26354
bugzilla.redhat.com/show_bug.cgi?id=2063257
gitlab.com/qemu-project/qemu/-/commit/8d1b247f3748ac4078524130c6d7ae42b6140aaf
lists.debian.org/debian-lts-announce/2022/04/msg00002.html
lists.debian.org/debian-lts-announce/2022/09/msg00008.html
security-tracker.debian.org/tracker/CVE-2022-26354
security.gentoo.org/glsa/202208-27
security.netapp.com/advisory/ntap-20220425-0003/
www.debian.org/security/2022/dsa-5133
Related
3.2 Low
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L
2.1 Low
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:N/I:N/A:P