#VU79262 Information exposure through microarchitectural state after transient execution in Xen - CVE-2022-40982
Published: August 8, 2023
Vulnerability identifier: #VU79262
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:U/U:Green
CVE-ID: CVE-2022-40982
CWE-ID: CWE-1342
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Xen
Xen
Software vendor:
Xen Project
Xen Project
Description
The vulnerability allows a malicious guest to escalate privileges on the system.
The vulnerability exists due to the way data is shared between threads whereby the AVX GATHER instructions on Intel processors can forward the content of stale vector registers to dependent instructions. A malicious guest can infer data from different contexts on the same core and execute arbitrary code with elevated privileges.
Remediation
Install updates from vendor's website.