CVE-2022-42327

NameCVE-2022-42327
Descriptionx86: unintended memory sharing between guests On Intel systems that support the "virtualize APIC accesses" feature, a guest can read and write the global shared xAPIC page by moving the local APIC out of xAPIC mode. Access to this shared page bypasses the expected isolation that should exist between two guests.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
xen (PTS)buster, buster (security)4.11.4+107-gef32c7afa2-1fixed
bullseye4.14.6-1fixed
bullseye (security)4.14.5+94-ge49571868d-1fixed
bookworm4.17.3+10-g091466ba55-1~deb12u1fixed
trixie4.17.3+10-g091466ba55-1fixed
sid4.17.3+36-g54dacb5c02-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
xensourcebuster(not affected)
xensourcebullseye(not affected)
xensource(unstable)4.16.2+90-g0d39a6d1ae-1

Notes

[bullseye] - xen <not-affected> (Vulnerable code introduced later in 4.16)
[buster] - xen <not-affected> (Vulnerable code introduced later in 4.16)
https://xenbits.xen.org/xsa/advisory-412.html

Search for package or bug name: Reporting problems