Processor optimization removal or modification of security-critical code in Xen - CVE-2022-42331
Published: March 21, 2023
Vulnerability identifier: #VU73892
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2022-42331
CWE-ID: CWE-1037
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Xen Project
Affected software:
Xen
Xen
Detailed vulnerability description
The vulnerability allows an attacker to escalate privileges on the system.
The vulnerability exists due to an oversight in the very original Spectre/Meltdown security work (XSA-254) caused by an unprotected RET instruction. An attacker with access to the guest OS can infer the contents of arbitrary host memory, including memory assigned to other guests.
How to mitigate CVE-2022-42331
Install updates from vendor's website.