CVE-2022-26365
Assigner: XEN
Published: 2022-07-05T12:50:28
State: PUBLISHED
affected: product: Linux
vendor: Linux
versions: status: unknown
version: consult Xen advisory XSA-403
product: xen
vendor: Xen
versions: status: unknown
version: consult Xen advisory XSA-403
credits: value: {'credit_data': {'description': {'description_data': [{'lang': 'eng', 'value': 'The issue related to not zeroing memory areas used for shared communications\nwas discovered by Roger Pau Monné of Citrix.\n\nThe issue related to leaking contiguous data in granted pages was disclosed\npublicly.'}]}}}
descriptions: value: Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742).
metrics: other: content: description: description_data: value: An untrusted backend can access data not intended to be shared.  If such
mappings are made with write permissions the backend could also cause
malfunctions and/or crashes to consumers of contiguous data in the shared
pages.
type: unknown
problemTypes: descriptions: description: unknown
type: text