x86: unintended memory sharing between guests On Intel systems that support the "virtualize APIC accesses" feature, a guest can read and write the global shared xAPIC page by moving the local APIC out of xAPIC mode. Access to this shared page bypasses the expected isolation that should exist between two guests.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - x86: unintended memory sharing between guests On Intel systems that support the virtualize APIC accesses     feature, a guest can read and write the global shared xAPIC page by moving the local APIC out of xAPIC     mode. Access to this shared page bypasses the expected isolation that should exist between two guests.
    (CVE-2022-42327)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Xenstore: Guests can crash xenstored Due to a bug in the fix of XSA-115 a malicious guest can cause
    xenstored to use a wrong pointer during node creation in an error path, resulting in a crash of xenstored
    or a memory corruption in xenstored causing further damage. Entering the error path can be controlled by
    the guest e.g. by exceeding the quota value of maximum nodes per domain. (CVE-2022-42309)

  - x86: unintended memory sharing between guests On Intel systems that support the "virtualize APIC accesses"
    feature, a guest can read and write the global shared xAPIC page by moving the local APIC out of xAPIC
    mode. Access to this shared page bypasses the expected isolation that should exist between two guests.
    (CVE-2022-42327)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-9f51d13fa3 advisory.

    x86: Multiple speculative security issues [XSA-422, CVE-2022-23824]

    ----

    x86: unintended memory sharing between guests [XSA-412, CVE-2022-42327]     Xenstore: Guests can crash xenstored [XSA-414, CVE-2022-42309]     Xenstore: Guests can create orphaned Xenstore nodes [XSA-415,     CVE-2022-42310]     Xenstore: guests can let run xenstored out of memory [XSA-326,     CVE-2022-42311, CVE-2022-42312, CVE-2022-42313, CVE-2022-42314,     CVE-2022-42315, CVE-2022-42316, CVE-2022-42317, CVE-2022-42318]     Xenstore: Guests can cause Xenstore to not free temporary memory     [XSA-416, CVE-2022-42319]     Xenstore: Guests can get access to Xenstore nodes of deleted domains     [XSA-417, CVE-2022-42320]     Xenstore: Guests can crash xenstored via exhausting the stack     [XSA-418, CVE-2022-42321]     Xenstore: Cooperating guests can create arbitrary numbers of nodes     [XSA-419, CVE-2022-42322, CVE-2022-42323]     Oxenstored 32->31 bit integer truncation issues [XSA-420, CVE-2022-42324]     Xenstore: Guests can create arbitrary number of nodes via transactions     [XSA-421, CVE-2022-42325, CVE-2022-42326]

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202402-07 (Xen: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in Xen. Please review the CVE identifiers referenced below     for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - network backend may cause Linux netfront to use freed SKBs While adding logic to support XDP (eXpress Data
    Path), a code label was moved in a way allowing for SKBs having references (pointers) retained for further
    processing to nevertheless be freed. (CVE-2022-33743)

  - IBPB may not prevent return branch predictions from being specified by pre-IBPB branch targets leading to
    a potential information disclosure. (CVE-2022-23824)

  - Arm guests can cause Dom0 DoS via PV devices When mapping pages of guests on Arm, dom0 is using an rbtree
    to keep track of the foreign mappings. Updating of that rbtree is not always done completely with the
    related lock held, resulting in a small race window, which can be used by unprivileged guests via PV
    devices to cause inconsistencies of the rbtree. These inconsistencies can lead to Denial of Service (DoS)
    of dom0, e.g. by causing crashes or the inability to perform further mappings of other guests' memory
    pages. (CVE-2022-33744)

  - P2M pool freeing may take excessively long The P2M pool backing second level address translation for
    guests may be of significant size. Therefore its freeing may take more time than is reasonable without
    intermediate preemption checks. Such checking for the need to preempt was so far missing. (CVE-2022-33746)

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-07438e12df advisory.

    x86: unintended memory sharing between guests [XSA-412, CVE-2022-42327]     Xenstore: Guests can crash xenstored [XSA-414, CVE-2022-42309]     Xenstore: Guests can create orphaned Xenstore nodes [XSA-415,     CVE-2022-42310]     Xenstore: guests can let run xenstored out of memory [XSA-326,     CVE-2022-42311, CVE-2022-42312, CVE-2022-42313, CVE-2022-42314,     CVE-2022-42315, CVE-2022-42316, CVE-2022-42317, CVE-2022-42318]     Xenstore: Guests can cause Xenstore to not free temporary memory     [XSA-416, CVE-2022-42319]     Xenstore: Guests can get access to Xenstore nodes of deleted domains     [XSA-417, CVE-2022-42320]     Xenstore: Guests can crash xenstored via exhausting the stack     [XSA-418, CVE-2022-42321]     Xenstore: Cooperating guests can create arbitrary numbers of nodes     [XSA-419, CVE-2022-42322, CVE-2022-42323]     Oxenstored 32->31 bit integer truncation issues [XSA-420, CVE-2022-42324]     Xenstore: Guests can create arbitrary number of nodes via transactions     [XSA-421, CVE-2022-42325, CVE-2022-42326]

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4007-1 advisory.

    - CVE-2022-33746: Fixed DoS due to excessively long P2M pool freeing (bsc#1203806).
    - CVE-2022-33748: Fixed DoS due to race in locking (bsc#1203807).
    - CVE-2022-42311, CVE-2022-42312, CVE-2022-42313, CVE-2022-42314, CVE-2022-42315, CVE-2022-42316,     CVE-2022-42317, CVE-2022-42318: xen: Xenstore: Guests can let xenstored run out of memory (bsc#1204482)
    - CVE-2022-42309: xen: Xenstore: Guests can crash xenstored (bsc#1204485)
    - CVE-2022-42310: xen: Xenstore: Guests can create orphaned Xenstore nodes (bsc#1204487)
    - CVE-2022-42319: xen: Xenstore: Guests can cause Xenstore to not free temporary memory (bsc#1204488)
    - CVE-2022-42320: xen: Xenstore: Guests can get access to Xenstore nodes of deleted domains (bsc#1204489)
    - CVE-2022-42321: xen: Xenstore: Guests can crash xenstored via exhausting the stack (bsc#1204490)
    - CVE-2022-42322,CVE-2022-42323: xen: Xenstore: cooperating guests can create arbitrary numbers of nodes     (bsc#1204494)
    - CVE-2022-42325,CVE-2022-42326: xen: Xenstore: Guests can create arbitrary number of nodes via     transactions (bsc#1204496)
    - xen: Frontends vulnerable to backends (bsc#1193923).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
255740	Linux Distros Unpatched Vulnerability : CVE-2022-42327	Nessus	Misc.	high
424679	Alpine: multiple xen packages: security update to 4.16.2-r1	Tenable Cloud Security	Alpine Linux Local Security Checks	high
424679	Alpine: multiple xen packages: security update to 4.16.2-r1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
211096	Fedora 37 : xen (2022-9f51d13fa3)	Nessus	Fedora Local Security Checks	high
189976	GLSA-202402-07 : Xen: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
407821	Alpine: xen: security update to 4.15.4-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
407821	Alpine: xen: security update to 4.15.4-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
169223	Fedora 36 : xen (2022-07438e12df)	Nessus	Fedora Local Security Checks	high
167763	SUSE SLED15: xen / xen-devel / xen-doc-html / xen-libs / xen-libs-32bit / etc (SUSE-SU-2022:4007-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2022-42327

high

Tenable Plugins

high

high

high

high

high

high

high

high

high